ysk-server-core 1.0.0

package/dist/hosting/vpn/access-mode.js

@@ -0,0 +1,126 @@
+/**
+ * VPN access mode helpers — routes, AllowedIPs, NAT need.
+ */
+import { DEFAULT_VPN_LAN_CIDRS } from './types.js';
+export function parseAccessMode(raw) {
+    const s = String(raw ?? 'full').toLowerCase();
+    if (s === 'lan' || s === 'local' || s === 'split')
+        return 'lan';
+    if (s === 'custom')
+        return 'custom';
+    return 'full';
+}
+export function normalizeVpnCidrList(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const x of raw) {
+        const c = String(x ?? '').trim();
+        if (/^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/.test(c))
+            out.push(c);
+    }
+    return [...new Set(out)];
+}
+/** CIDR → OpenVPN push "route a.b.c.d netmask" */
+export function cidrToOvpnRoutePush(cidr) {
+    const m = cidr.trim().match(/^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\/(\d{1,2})$/);
+    if (!m)
+        return null;
+    const ip = m[1];
+    const prefix = Number(m[2]);
+    if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32)
+        return null;
+    const maskNum = prefix === 0 ? 0 : ((0xffffffff << (32 - prefix)) >>> 0);
+    const mask = [24, 16, 8, 0].map((s) => (maskNum >>> s) & 255).join('.');
+    return `push "route ${ip} ${mask}"`;
+}
+export function needsInternetNat(mode, customCidrs) {
+    if (mode === 'full')
+        return true;
+    if (mode === 'custom') {
+        return customCidrs.some((c) => c === '0.0.0.0/0' || c === '::/0');
+    }
+    return false;
+}
+/** WireGuard client AllowedIPs for access mode */
+export function wgClientAllowedIps(mode, opts) {
+    const vpnNet = opts?.vpnNet ?? '10.66.66.0/24';
+    if (mode === 'full')
+        return '0.0.0.0/0, ::/0';
+    if (mode === 'custom') {
+        const list = normalizeVpnCidrList(opts?.customCidrs ?? []);
+        return list.length ? list.join(', ') : vpnNet;
+    }
+    // lan
+    const lan = normalizeVpnCidrList(opts?.lanCidrs ?? [...DEFAULT_VPN_LAN_CIDRS]);
+    const parts = [vpnNet, ...lan];
+    return [...new Set(parts)].join(', ');
+}
+/** OpenVPN server push lines for access mode (excluding DNS). */
+export function ovpnAccessPushLines(mode, opts) {
+    const lines = [];
+    if (mode === 'full') {
+        lines.push('push "redirect-gateway def1 bypass-dhcp"');
+        return lines;
+    }
+    const vpnCidr = opts?.vpnNetCidr ?? '10.8.0.0/24';
+    const vpnPush = cidrToOvpnRoutePush(vpnCidr);
+    if (vpnPush)
+        lines.push(vpnPush);
+    const cidrs = mode === 'custom'
+        ? normalizeVpnCidrList(opts?.customCidrs ?? [])
+        : normalizeVpnCidrList(opts?.lanCidrs ?? [...DEFAULT_VPN_LAN_CIDRS]);
+    for (const c of cidrs) {
+        if (c === vpnCidr)
+            continue;
+        const p = cidrToOvpnRoutePush(c);
+        if (p)
+            lines.push(p);
+    }
+    return lines;
+}
+/**
+ * Idempotent iptables NAT + forward for VPN clients.
+ * Works with UFW DEFAULT_FORWARD_POLICY=DROP by inserting at top of FORWARD.
+ * comment mark YSK-VPN for cleanup.
+ */
+export function buildVpnNatShell(input) {
+    const src = input.sourceCidr;
+    const mark = input.mark.replace(/[^A-Za-z0-9_-]/g, '') || 'YSK-VPN';
+    const hint = input.tunnelIfaceHint.replace(/[^A-Za-z0-9_.-]/g, '') || 'tun0';
+    const wan = `WAN=$(ip route 2>/dev/null | awk '/default/{print $5; exit}')`;
+    // Prefer exact iface (tun0 / wg0). Never let broad /^wg/ steal OpenVPN's TUN.
+    const tun = [
+        `HINT=${JSON.stringify(hint)}`,
+        'if [ -n "$HINT" ] && ip link show "$HINT" >/dev/null 2>&1; then TUN="$HINT"',
+        `elif [ "$HINT" = "tun0" ] && TUN=$(ip -br link 2>/dev/null | awk '/^tun[0-9]/{print $1; exit}'); [ -n "$TUN" ]; then :`,
+        `elif [ "$HINT" = "wg0" ] && TUN=$(ip -br link 2>/dev/null | awk '/^wg[0-9]/{print $1; exit}'); [ -n "$TUN" ]; then :`,
+        'else TUN="$HINT"; fi',
+    ].join('\n');
+    const lines = [
+        'set +e',
+        'sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true',
+        wan,
+        tun,
+        'if [ -z "$WAN" ]; then echo "YSK-VPN: no default WAN iface"; exit 0; fi',
+        // cleanup old marked rules (best-effort)
+        `iptables-save 2>/dev/null | grep -F ${JSON.stringify(mark)} | sed 's/^-A /iptables -D /' | while read -r _cmd; do eval "$_cmd" 2>/dev/null || true; done`,
+        // Also strip any previous accidental mis-tagged lines for this source
+        `iptables-save -t filter 2>/dev/null | grep -F ${JSON.stringify(mark)} | sed 's/^-A /iptables -D /' | while read -r _cmd; do eval "$_cmd" 2>/dev/null || true; done`,
+    ];
+    if (input.enableNat) {
+        // -I 1: must sit BEFORE ufw-before-forward / ufw-reject-forward (policy DROP)
+        lines.push(`iptables -C FORWARD -i "$TUN" -j ACCEPT -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -I FORWARD 1 -i "$TUN" -j ACCEPT -m comment --comment ${JSON.stringify(mark)}`, `iptables -C FORWARD -o "$TUN" -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -I FORWARD 1 -o "$TUN" -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment ${JSON.stringify(mark)}`, `iptables -C FORWARD -i "$TUN" -o "$WAN" -j ACCEPT -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -I FORWARD 1 -i "$TUN" -o "$WAN" -j ACCEPT -m comment --comment ${JSON.stringify(mark)}`, `iptables -C FORWARD -i "$WAN" -o "$TUN" -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -I FORWARD 1 -i "$WAN" -o "$TUN" -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment ${JSON.stringify(mark)}`, `iptables -t nat -C POSTROUTING -s ${JSON.stringify(src)} -o "$WAN" -j MASQUERADE -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -t nat -A POSTROUTING -s ${JSON.stringify(src)} -o "$WAN" -j MASQUERADE -m comment --comment ${JSON.stringify(mark)}`, 
+        // UFW route (multi-host with ufw active) — ignore if ufw absent
+        `if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qi active; then ufw route allow in on "$TUN" out on "$WAN" 2>/dev/null || true; ufw route allow in on "$WAN" out on "$TUN" 2>/dev/null || true; fi`, 'echo "YSK-VPN: full NAT applied iface=$TUN wan=$WAN src=' + src + '"');
+    }
+    else {
+        const lans = input.lanCidrs?.length ? input.lanCidrs : [...DEFAULT_VPN_LAN_CIDRS];
+        for (const lan of lans) {
+            lines.push(`iptables -C FORWARD -s ${JSON.stringify(src)} -d ${JSON.stringify(lan)} -j ACCEPT -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -I FORWARD 1 -s ${JSON.stringify(src)} -d ${JSON.stringify(lan)} -j ACCEPT -m comment --comment ${JSON.stringify(mark)}`);
+        }
+        lines.push(`iptables -C FORWARD -d ${JSON.stringify(src)} -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment ${JSON.stringify(mark)} 2>/dev/null || iptables -I FORWARD 1 -d ${JSON.stringify(src)} -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment ${JSON.stringify(mark)}`, 'echo "YSK-VPN: lan forward only (no internet NAT)"');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=access-mode.js.map

package/dist/hosting/vpn/access-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-mode.js","sourceRoot":"","sources":["../../../src/hosting/vpn/access-mode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAY,CAAC;IACrF,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,eAAe,EAAE,IAAI,IAAI,GAAG,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAmB,EAAE,WAAqB;IACzE,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAChC,IAAmB,EACnB,IAAuE;IAEvE,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,iBAAiB,CAAC;IAC9C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IACD,MAAM;IACN,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CACjC,IAAmB,EACnB,IAA2E;IAE3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,EAAE,UAAU,IAAI,aAAa,CAAC;IAClD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,KAAK,GACT,IAAI,KAAK,QAAQ;QACf,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,OAAO;YAAE,SAAS;QAC5B,MAAM,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAShC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;IAC7E,MAAM,GAAG,GAAG,+DAA+D,CAAC;IAC5E,8EAA8E;IAC9E,MAAM,GAAG,GAAG;QACV,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC9B,6EAA6E;QAC7E,wHAAwH;QACxH,sHAAsH;QACtH,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,yDAAyD;QACzD,GAAG;QACH,GAAG;QACH,yEAAyE;QACzE,yCAAyC;QACzC,uCAAuC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+FAA+F;QAC1J,sEAAsE;QACtE,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+FAA+F;KACrK,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,8EAA8E;QAC9E,KAAK,CAAC,IAAI,CACR,gEAAgE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kFAAkF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAC5L,qGAAqG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uHAAuH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EACtQ,0EAA0E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4FAA4F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAChN,+GAA+G,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iIAAiI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAC1R,qCAAqC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qDAAqD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5Q,gEAAgE;QAChE,wNAAwN,EACxN,0DAA0D,GAAG,GAAG,GAAG,GAAG,CACvE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CACR,0BAA0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,0BAA0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wEAAwE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wEAAwE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EACtS,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/hosting/vpn/client-conf-protect.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Outbound VPN client conf hardening for ysk-server hosts.
+ *
+ * Full-tunnel clients (AllowedIPs = 0.0.0.0/0) replace the default route.
+ * Replies to the panel / SSH / public services then leave via the tunnel →
+ * clients cannot reach the panel. Fix: source-based policy routing so
+ * traffic FROM local interface IPs always uses the main table.
+ */
+/** Detect full-tunnel AllowedIPs (IPv4 and/or IPv6 default). */
+export declare function isFullTunnelAllowedIps(text: string): boolean;
+/** Extract first IPv4 Endpoint host (hostname or IP). */
+export declare function extractWgEndpointHost(conf: string): string | null;
+/**
+ * Shell body written to /usr/local/lib/ysk-server/vpn-client-protect.sh
+ * Usage: vpn-client-protect.sh up|down [iface]
+ */
+export declare function buildVpnClientProtectScript(): string;
+/**
+ * Inject PostUp/PreDown host protection into a WireGuard client conf.
+ * Idempotent (strips previous YSK protect block first).
+ * Does not remove full tunnel — keeps user's intent but fixes panel access.
+ */
+export declare function injectWgClientHostProtection(conf: string): {
+    conf: string;
+    fullTunnel: boolean;
+    modified: boolean;
+};
+//# sourceMappingURL=client-conf-protect.d.ts.map

package/dist/hosting/vpn/client-conf-protect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-conf-protect.d.ts","sourceRoot":"","sources":["../../../src/hosting/vpn/client-conf-protect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW5D;AAED,yDAAyD;AACzD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMjE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAuDpD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,CA4CA"}

package/dist/hosting/vpn/client-conf-protect.js

@@ -0,0 +1,138 @@
+/**
+ * Outbound VPN client conf hardening for ysk-server hosts.
+ *
+ * Full-tunnel clients (AllowedIPs = 0.0.0.0/0) replace the default route.
+ * Replies to the panel / SSH / public services then leave via the tunnel →
+ * clients cannot reach the panel. Fix: source-based policy routing so
+ * traffic FROM local interface IPs always uses the main table.
+ */
+const MARK_BEGIN = '# YSK-CLIENT-HOST-PROTECT-BEGIN';
+const MARK_END = '# YSK-CLIENT-HOST-PROTECT-END';
+/** Detect full-tunnel AllowedIPs (IPv4 and/or IPv6 default). */
+export function isFullTunnelAllowedIps(text) {
+    // Match AllowedIPs lines containing 0.0.0.0/0 or ::/0
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        if (!/^\s*AllowedIPs\s*=/i.test(line))
+            continue;
+        const v = line.split('=')[1] ?? '';
+        if (/\b0\.0\.0\.0\/0\b/.test(v) || /(^|[\s,])::\/0([\s,]|$)/.test(v)) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Extract first IPv4 Endpoint host (hostname or IP). */
+export function extractWgEndpointHost(conf) {
+    for (const line of conf.split(/\r?\n/)) {
+        const m = line.match(/^\s*Endpoint\s*=\s*([^:\s]+)/i);
+        if (m?.[1])
+            return m[1].trim();
+    }
+    return null;
+}
+/**
+ * Shell body written to /usr/local/lib/ysk-server/vpn-client-protect.sh
+ * Usage: vpn-client-protect.sh up|down [iface]
+ */
+export function buildVpnClientProtectScript() {
+    return `#!/bin/bash
+# YSK: keep panel/SSH reachable when outbound VPN is full-tunnel
+set +e
+ACTION="\${1:-up}"
+TAG="ysk-vpn-client-src"
+# priority band reserved for YSK client protect
+PRIO=52
+
+list_local_ips() {
+  ip -4 -o addr show up 2>/dev/null | awk '
+    $2 ~ /^(lo|wg|tun|tap|docker|veth|br-)/ { next }
+    $2 ~ /^wg-/ { next }
+    {
+      split($4, a, "/");
+      if (a[1] != "" && a[1] != "127.0.0.1") print a[1];
+    }'
+}
+
+add_rules() {
+  while read -r ip; do
+    [ -z "\$ip" ] && continue
+    # idempotent: delete then add
+    ip rule del from "\$ip" lookup main priority \$PRIO 2>/dev/null
+    ip rule add from "\$ip" lookup main priority \$PRIO 2>/dev/null || true
+  done < <(list_local_ips)
+  # also protect link-local return for default WAN iface
+  WAN=\$(ip route 2>/dev/null | awk '/default/{print \$5; exit}')
+  if [ -n "\$WAN" ]; then
+    WIP=\$(ip -4 -o addr show dev "\$WAN" 2>/dev/null | awk '{split(\$4,a,"/"); print a[1]; exit}')
+    if [ -n "\$WIP" ]; then
+      ip rule del from "\$WIP" lookup main priority \$PRIO 2>/dev/null
+      ip rule add from "\$WIP" lookup main priority \$PRIO 2>/dev/null || true
+    fi
+  fi
+  echo "YSK-CLIENT-PROTECT: source rules applied (prio=\$PRIO)"
+}
+
+del_rules() {
+  # remove all our priority rules
+  ip rule show 2>/dev/null | awk -v p=\$PRIO '\$1==p":"{print}' | while read -r line; do
+    # e.g. "52:    from 1.2.3.4 lookup main"
+    fr=\$(echo "\$line" | awk '{for(i=1;i<=NF;i++) if(\$i=="from"){print \$(i+1); exit}}')
+    [ -n "\$fr" ] && ip rule del from "\$fr" lookup main priority \$PRIO 2>/dev/null || true
+  done
+  echo "YSK-CLIENT-PROTECT: source rules cleared"
+}
+
+case "\$ACTION" in
+  up) add_rules ;;
+  down) del_rules ;;
+  *) echo "usage: \$0 up|down"; exit 2 ;;
+esac
+exit 0
+`;
+}
+/**
+ * Inject PostUp/PreDown host protection into a WireGuard client conf.
+ * Idempotent (strips previous YSK protect block first).
+ * Does not remove full tunnel — keeps user's intent but fixes panel access.
+ */
+export function injectWgClientHostProtection(conf) {
+    const fullTunnel = isFullTunnelAllowedIps(conf);
+    let body = conf.replace(/\r\n/g, '\n');
+    // strip previous block
+    const re = new RegExp(`\\n?${MARK_BEGIN}[\\s\\S]*?${MARK_END}\\n?`, 'g');
+    body = body.replace(re, '\n');
+    if (!fullTunnel) {
+        return { conf: body.endsWith('\n') ? body : body + '\n', fullTunnel: false, modified: false };
+    }
+    const block = [
+        MARK_BEGIN,
+        '# Keep ysk-server panel/SSH reachable (source-route via main table)',
+        'PostUp = /usr/local/lib/ysk-server/vpn-client-protect.sh up %i',
+        'PreDown = /usr/local/lib/ysk-server/vpn-client-protect.sh down %i',
+        MARK_END,
+        '',
+    ].join('\n');
+    // Insert after [Interface] section header (first occurrence)
+    if (/\[Interface\]/i.test(body)) {
+        body = body.replace(/(\[Interface\][^\n]*\n)/i, `$1${block}`);
+    }
+    else {
+        body = block + body;
+    }
+    // Soften DNS takeover on control-plane hosts: comment DNS= so host resolv stays usable
+    // (full-tunnel DNS to remote often breaks local panel hostname resolution)
+    body = body
+        .split('\n')
+        .map((line) => {
+        if (/^\s*DNS\s*=/i.test(line) && !line.trim().startsWith('#')) {
+            return `# YSK: DNS disabled on control-plane host (was: ${line.trim()})\n#${line}`;
+        }
+        return line;
+    })
+        .join('\n');
+    if (!body.endsWith('\n'))
+        body += '\n';
+    return { conf: body, fullTunnel: true, modified: true };
+}
+//# sourceMappingURL=client-conf-protect.js.map

package/dist/hosting/vpn/client-conf-protect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-conf-protect.js","sourceRoot":"","sources":["../../../src/hosting/vpn/client-conf-protect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,UAAU,GAAG,iCAAiC,CAAC;AACrD,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEjD,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,sDAAsD;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDR,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IAKvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,uBAAuB;IACvB,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,OAAO,UAAU,aAAa,QAAQ,MAAM,EAC5C,GAAG,CACJ,CAAC;IACF,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,UAAU;QACV,qEAAqE;QACrE,gEAAgE;QAChE,mEAAmE;QACnE,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,6DAA6D;IAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uFAAuF;IACvF,2EAA2E;IAC3E,IAAI,GAAG,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO,mDAAmD,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,IAAI,IAAI,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC"}

package/dist/hosting/vpn/endpoint.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared public endpoint parsing for WireGuard / OpenVPN / Shadowsocks.
+ * Rejects common typos like "51820:1194" (WG port used as host).
+ */
+import type { HostExecutor } from '../../host/executor.js';
+export type ParsedVpnEndpoint = {
+    host: string;
+    port: number;
+    ok: boolean;
+};
+/** True if host looks like a real hostname / IP (not a bare port number). */
+export declare function isValidEndpointHost(host: string): boolean;
+/**
+ * Parse panel "公開端點" host[:port].
+ * - "1.2.3.4:1194" → host 1.2.3.4, port 1194
+ * - "vpn.example.com" → host + listenPort
+ * - "51820:1194" → invalid (digits-only host)
+ * - "[::1]:1194" → IPv6
+ */
+export declare function parseVpnEndpoint(endpoint: string | undefined | null, listenPort: number): ParsedVpnEndpoint;
+export declare function formatVpnEndpoint(host: string, port: number): string;
+/** Best-effort public IPv4:port for client conf / QR. */
+export declare function guessPublicEndpoint(host: HostExecutor, port: number): Promise<string>;
+/** Patch OpenVPN client conf `remote` line to current host/port. */
+export declare function applyOvpnRemote(config: string, host: string, port: number): string;
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/hosting/vpn/endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../../src/hosting/vpn/endpoint.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;CACb,CAAC;AAEF,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACnC,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAkCnB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,yDAAyD;AACzD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,MAAM,CASR"}

package/dist/hosting/vpn/endpoint.js

@@ -0,0 +1,90 @@
+/**
+ * Shared public endpoint parsing for WireGuard / OpenVPN / Shadowsocks.
+ * Rejects common typos like "51820:1194" (WG port used as host).
+ */
+/** True if host looks like a real hostname / IP (not a bare port number). */
+export function isValidEndpointHost(host) {
+    const h = host.trim();
+    if (!h)
+        return false;
+    if (/^\d+$/.test(h))
+        return false;
+    return true;
+}
+/**
+ * Parse panel "公開端點" host[:port].
+ * - "1.2.3.4:1194" → host 1.2.3.4, port 1194
+ * - "vpn.example.com" → host + listenPort
+ * - "51820:1194" → invalid (digits-only host)
+ * - "[::1]:1194" → IPv6
+ */
+export function parseVpnEndpoint(endpoint, listenPort) {
+    const raw = (endpoint || '').trim();
+    if (!raw)
+        return { host: 'YOUR_PUBLIC_IP', port: listenPort, ok: false };
+    // [ipv6]:port
+    const v6 = raw.match(/^\[([^\]]+)\](?::(\d+))?$/);
+    if (v6) {
+        const host = v6[1];
+        return {
+            host,
+            port: v6[2] ? Number(v6[2]) : listenPort,
+            ok: isValidEndpointHost(host) || host.includes(':'),
+        };
+    }
+    const parts = raw.split(':');
+    if (parts.length === 1) {
+        const h = parts[0].trim();
+        const ok = isValidEndpointHost(h);
+        return { host: ok ? h : 'YOUR_PUBLIC_IP', port: listenPort, ok };
+    }
+    // host:port — last segment is port when numeric
+    const portStr = parts[parts.length - 1];
+    const host = parts.slice(0, -1).join(':').trim();
+    const port = /^\d+$/.test(portStr) ? Number(portStr) : listenPort;
+    if (!isValidEndpointHost(host)) {
+        return { host: 'YOUR_PUBLIC_IP', port: listenPort, ok: false };
+    }
+    return {
+        host,
+        port: Number.isFinite(port) && port > 0 && port <= 65535 ? port : listenPort,
+        ok: true,
+    };
+}
+export function formatVpnEndpoint(host, port) {
+    const h = host.trim();
+    if (!isValidEndpointHost(h) && !h.includes(':'))
+        return '';
+    if (h.includes(':') && !h.startsWith('['))
+        return `[${h}]:${port}`;
+    return `${h}:${port}`;
+}
+/** Best-effort public IPv4:port for client conf / QR. */
+export async function guessPublicEndpoint(host, port) {
+    try {
+        const r = await host.runCommand([
+            'bash',
+            '-c',
+            'curl -4 -fsS --max-time 3 https://ifconfig.me/ip 2>/dev/null || curl -4 -fsS --max-time 3 https://api.ipify.org 2>/dev/null || curl -4 -fsS --max-time 3 https://icanhazip.com 2>/dev/null || true',
+        ], { timeoutMs: 10_000 });
+        const ip = (r.stdout || '').trim().split(/\s+/)[0] || '';
+        if (ip && /^\d+\.\d+\.\d+\.\d+$/.test(ip))
+            return `${ip}:${port}`;
+    }
+    catch {
+        /* */
+    }
+    return '';
+}
+/** Patch OpenVPN client conf `remote` line to current host/port. */
+export function applyOvpnRemote(config, host, port) {
+    const line = `remote ${host} ${port}`;
+    if (/^remote\s+/m.test(config)) {
+        return config.replace(/^remote\s+.+$/m, line);
+    }
+    if (/^proto\s+/m.test(config)) {
+        return config.replace(/^(proto\s+\S+)\s*$/m, `$1\n${line}`);
+    }
+    return `${line}\n${config}`;
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/hosting/vpn/endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../../src/hosting/vpn/endpoint.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmC,EACnC,UAAkB;IAElB,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAEzE,cAAc;IACd,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClD,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QACpB,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;YACxC,EAAE,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,gDAAgD;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAClE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;QAC5E,EAAE,EAAE,IAAI;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACnE,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAkB,EAClB,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAC7B;YACE,MAAM;YACN,IAAI;YACJ,oMAAoM;SACrM,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,EAAE,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,IAAY,EACZ,IAAY;IAEZ,MAAM,IAAI,GAAG,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/hosting/vpn/index.d.ts

@@ -0,0 +1,12 @@
+export * from './types.js';
+export * from './ports.js';
+export * from './access-mode.js';
+export * from './endpoint.js';
+export * from './client-conf-protect.js';
+export * from './wireguard-conf.js';
+export * from './openvpn-conf.js';
+export * from './openvpn-ops.js';
+export * from './outline-ops.js';
+export * from './monitor.js';
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/hosting/vpn/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hosting/vpn/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/hosting/vpn/index.js

@@ -0,0 +1,12 @@
+export * from './types.js';
+export * from './ports.js';
+export * from './access-mode.js';
+export * from './endpoint.js';
+export * from './client-conf-protect.js';
+export * from './wireguard-conf.js';
+export * from './openvpn-conf.js';
+export * from './openvpn-ops.js';
+export * from './outline-ops.js';
+export * from './monitor.js';
+export * from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/hosting/vpn/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/vpn/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/hosting/vpn/monitor.d.ts

@@ -0,0 +1,141 @@
+/**
+ * VPN live monitor — parse WireGuard dump / OpenVPN status; build snapshot.
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import type { VpnEngineId } from './types.js';
+/** Handshake within this many seconds ⇒ online */
+export declare const WG_ONLINE_HANDSHAKE_SEC = 180;
+export type VpnPresence = 'online' | 'idle' | 'offline' | 'never' | 'unknown';
+export type VpnMonitorPeerRow = {
+    id: string;
+    name: string;
+    engine: VpnEngineId;
+    address: string;
+    publicKey: string;
+    endpoint: string | null;
+    online: boolean;
+    presence: VpnPresence;
+    lastHandshakeAt: string | null;
+    transferRx: number | null;
+    transferTx: number | null;
+    rxRateBps: number | null;
+    txRateBps: number | null;
+    connectedSince: string | null;
+};
+export type VpnMonitorEngineRow = {
+    engine: VpnEngineId;
+    serverActive: boolean;
+    onlineCount: number;
+    peerCount: number;
+    transferRx: number | null;
+    transferTx: number | null;
+    rxRateBps: number | null;
+    txRateBps: number | null;
+    notes: string[];
+};
+export type VpnMonitorLocalClient = {
+    id: string;
+    name: string;
+    engine: VpnEngineId;
+    iface: string;
+    status: 'up' | 'down' | 'unknown';
+    transferRx: number | null;
+    transferTx: number | null;
+    rxRateBps: number | null;
+    txRateBps: number | null;
+};
+export type VpnMonitorSnapshot = {
+    sampledAt: string;
+    engines: VpnMonitorEngineRow[];
+    peers: VpnMonitorPeerRow[];
+    localClients: VpnMonitorLocalClient[];
+    blocked?: boolean;
+    requiresExecute?: boolean;
+    requiresRoot?: boolean;
+    notes: string[];
+};
+export type WgDumpPeer = {
+    iface: string;
+    publicKey: string;
+    endpoint: string;
+    allowedIps: string;
+    latestHandshake: number;
+    transferRx: number;
+    transferTx: number;
+};
+export type WgDumpIface = {
+    name: string;
+    listenPort: number;
+    publicKey: string;
+};
+/** Parse `wg show all dump` (tab-separated). */
+export declare function parseWgDump(text: string): {
+    interfaces: WgDumpIface[];
+    peers: WgDumpPeer[];
+};
+export declare function presenceFromHandshake(latestHandshakeUnix: number, nowSec?: number): VpnPresence;
+export type OvpnStatusClient = {
+    commonName: string;
+    realAddress: string;
+    virtualAddress: string;
+    bytesReceived: number;
+    bytesSent: number;
+    connectedSinceUnix: number;
+    connectedSince: string | null;
+};
+/** Parse OpenVPN status-version 2/3 CLIENT_LIST and legacy status-version 1 client table. */
+export declare function parseOvpnStatus(text: string): OvpnStatusClient[];
+/** Primary status path written by openvpn (RuntimeDirectory is writable by the unit). */
+export declare function openVpnStatusPath(_dataDir: string): string;
+/** Fallbacks when unit layout differs (openvpn@ / daemon). */
+export declare function openVpnStatusCandidates(dataDir: string): string[];
+/** dataDir mirror path (optional read fallback) */
+export declare function openVpnStatusPathLocal(dataDir: string): string;
+/** Normalize tunnel IP for matching (strip /32, spaces). */
+export declare function normalizeTunnelIp(addr: string | undefined | null): string;
+export type RatePrevSample = {
+    atMs: number;
+    byKey: Record<string, {
+        rx: number;
+        tx: number;
+    }>;
+};
+export declare function rateFromPrev(key: string, rx: number, tx: number, nowMs: number, prev: RatePrevSample | null | undefined): {
+    rxRateBps: number | null;
+    txRateBps: number | null;
+};
+export type ControlPlanePeer = {
+    id: string;
+    name: string;
+    engine: VpnEngineId;
+    address: string;
+    publicKey: string;
+    createdAt?: string;
+};
+export type ControlPlaneClient = {
+    id: string;
+    name: string;
+    engine: VpnEngineId;
+    iface: string;
+    status: 'up' | 'down' | 'unknown' | 'error';
+};
+export declare function runWgShowDump(host: HostExecutor, iface?: string): Promise<string>;
+export declare function readOvpnStatusFile(host: HostExecutor, dataDir: string): Promise<string>;
+/** Match control-plane peer to OpenVPN status client by CN or virtual IP. */
+export declare function matchOvpnControlPeer(client: OvpnStatusClient, controlPeers: ControlPlanePeer[]): ControlPlanePeer | undefined;
+export declare function probeServerActive(host: HostExecutor, engine: VpnEngineId): Promise<boolean>;
+/**
+ * Build full monitor snapshot from control plane + live probes.
+ */
+export declare function buildMonitorSnapshot(input: {
+    host: HostExecutor;
+    dataDir: string;
+    controlPeers: ControlPlanePeer[];
+    controlClients: ControlPlaneClient[];
+    prev?: RatePrevSample | null;
+    nowMs?: number;
+}): Promise<{
+    snapshot: VpnMonitorSnapshot;
+    nextPrev: RatePrevSample;
+}>;
+//# sourceMappingURL=monitor.d.ts.map

package/dist/hosting/vpn/monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.d.ts","sourceRoot":"","sources":["../../../src/hosting/vpn/monitor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,kDAAkD;AAClD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,WAAW,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;IACzC,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB,CAkCA;AAED,wBAAgB,qBAAqB,CACnC,mBAAmB,EAAE,MAAM,EAC3B,MAAM,SAAgC,GACrC,WAAW,CAMb;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkEhE;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CASjE;AAED,mDAAmD;AACnD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAOzE;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD,CAAC;AAEF,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GACtC;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAexD;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;CAC7C,CAAC;AAEF,wBAAsB,aAAa,CACjC,IAAI,EAAE,YAAY,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,EACxB,YAAY,EAAE,gBAAgB,EAAE,GAC/B,gBAAgB,GAAG,SAAS,CAY9B;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAkClB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,cAAc,EAAE,kBAAkB,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAAC,CAsStE"}