Release v2.2.0: restore safe Cascade double-VPN for servers.
Reintroduce entry-to-exit AmneziaWG/WireGuard cascade inspired by ryderams/amneziawg-cascade, with handshake and egress checks and no remote curl|bash.
This commit is contained in:
orohi
+323
-1
@@ -1,4 +1,4 @@
|
||||
{% extends "base.html" %}
|
||||
{% extends "base.html" %}
|
||||
{% from "macros/icons.html" import icon %}
|
||||
|
||||
{% block title_extra %} — {{ server.name }}{% endblock %}
|
||||
@@ -157,6 +157,153 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Cascade (double VPN) -->
|
||||
<section class="card" id="cascadeSection" style="margin-bottom: var(--space-xl);">
|
||||
<div class="card-header" style="align-items:flex-start; flex-wrap:wrap; gap:var(--space-sm);">
|
||||
<div>
|
||||
<h2 class="card-title" style="margin:0;">{{ _('cascade_title') }}</h2>
|
||||
<p class="form-hint" style="margin:var(--space-xs) 0 0;">{{ _('cascade_desc') }}</p>
|
||||
</div>
|
||||
<span class="badge badge-warn" id="cascadeStatusBadge">{{ _('cascade_off') }}</span>
|
||||
</div>
|
||||
<div style="padding: 0 var(--space-md) var(--space-md);">
|
||||
<div class="grid" style="display:grid; grid-template-columns:1fr 1fr; gap:var(--space-md);">
|
||||
<div class="form-group">
|
||||
<label class="form-label">{{ _('cascade_entry_protocol') }}</label>
|
||||
<select class="form-select" id="cascadeEntryProtocol">
|
||||
<option value="awg2" selected>AmneziaWG 2.0</option>
|
||||
<option value="awg">AmneziaWG</option>
|
||||
<option value="awg_legacy">AWG Legacy</option>
|
||||
<option value="wireguard">WireGuard</option>
|
||||
</select>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<label class="form-label">{{ _('cascade_exit_server') }}</label>
|
||||
<select class="form-select" id="cascadeExitServer" onchange="fillCascadeExitProtocols()">
|
||||
<option value="">{{ _('cascade_exit_server_none') }}</option>
|
||||
{% for s in all_servers %}
|
||||
{% if loop.index0 != server_id %}
|
||||
<option value="{{ loop.index0 }}"
|
||||
data-protocols="{% for k in (s.protocols or {}).keys() %}{{ k }}{% if not loop.last %},{% endif %}{% endfor %}">
|
||||
{{ s.name or s.host }} ({{ s.host }})
|
||||
</option>
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
</select>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<label class="form-label">{{ _('cascade_exit_protocol') }}</label>
|
||||
<select class="form-select" id="cascadeExitProtocol">
|
||||
<option value="awg2" selected>AmneziaWG 2.0</option>
|
||||
<option value="awg">AmneziaWG</option>
|
||||
<option value="awg_legacy">AWG Legacy</option>
|
||||
<option value="wireguard">WireGuard</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
<div class="form-hint" style="margin-bottom:var(--space-sm);">{{ _('cascade_hint') }}</div>
|
||||
<div class="form-hint" style="margin-bottom:var(--space-sm);">{{ _('cascade_client_note') }}</div>
|
||||
<div class="form-hint" style="margin-bottom:var(--space-md);">{{ _('cascade_security_note') }}</div>
|
||||
|
||||
<details id="cascadeSettingsPanel" open style="margin-bottom:var(--space-md); border:1px solid var(--border); border-radius:var(--radius-md); padding:var(--space-sm) var(--space-md);">
|
||||
<summary style="cursor:pointer; font-weight:600; margin-bottom:var(--space-sm);">{{ _('cascade_settings_title') }}</summary>
|
||||
<p class="form-hint" style="margin:0 0 var(--space-md);">{{ _('cascade_settings_desc') }}</p>
|
||||
<div class="grid" style="display:grid; grid-template-columns:1fr 1fr; gap:var(--space-sm) var(--space-md);">
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadePinExitRoute" checked>
|
||||
<span>
|
||||
<strong>{{ _('cascade_opt_pin_exit') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_opt_pin_exit_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadeRemoveEthMasq" checked>
|
||||
<span>
|
||||
<strong>{{ _('cascade_opt_remove_eth_masq') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_opt_remove_eth_masq_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadeForceForward" checked>
|
||||
<span>
|
||||
<strong>{{ _('cascade_opt_force_forward') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_opt_force_forward_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadeMssClamp" checked>
|
||||
<span>
|
||||
<strong>{{ _('cascade_opt_mss_clamp') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_opt_mss_clamp_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadeWaitHandshake" checked>
|
||||
<span>
|
||||
<strong>{{ _('cascade_opt_wait_handshake') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_opt_wait_handshake_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadeVerifyEgress" checked>
|
||||
<span>
|
||||
<strong>{{ _('cascade_verify_egress') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_verify_egress_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
|
||||
<input type="checkbox" id="cascadeKeepExitDns">
|
||||
<span>
|
||||
<strong>{{ _('cascade_opt_keep_dns') }}</strong>
|
||||
<span class="form-hint" style="display:block;">{{ _('cascade_opt_keep_dns_hint') }}</span>
|
||||
</span>
|
||||
</label>
|
||||
</div>
|
||||
<div class="grid" style="display:grid; grid-template-columns:1fr 1fr 1fr; gap:var(--space-md); margin-top:var(--space-md);">
|
||||
<div class="form-group" style="margin:0;">
|
||||
<label class="form-label" for="cascadeHandshakeTimeout">{{ _('cascade_opt_handshake_timeout') }}</label>
|
||||
<input type="number" class="form-input" id="cascadeHandshakeTimeout" min="5" max="120" value="25">
|
||||
</div>
|
||||
<div class="form-group" style="margin:0;">
|
||||
<label class="form-label" for="cascadeTableId">{{ _('cascade_opt_table_id') }}</label>
|
||||
<input type="number" class="form-input" id="cascadeTableId" min="1" max="252" value="200">
|
||||
</div>
|
||||
<div class="form-group" style="margin:0;">
|
||||
<label class="form-label" for="cascadeRulePriority">{{ _('cascade_opt_rule_priority') }}</label>
|
||||
<input type="number" class="form-input" id="cascadeRulePriority" min="1" max="32765" value="100">
|
||||
</div>
|
||||
</div>
|
||||
<div class="grid" style="display:grid; grid-template-columns:1fr 1fr; gap:var(--space-md); margin-top:var(--space-md);">
|
||||
<div class="form-group" style="margin:0;">
|
||||
<label class="form-label" for="cascadeAllowedIps">{{ _('cascade_opt_allowed_ips') }}</label>
|
||||
<input type="text" class="form-input" id="cascadeAllowedIps" value="0.0.0.0/0">
|
||||
<span class="form-hint">{{ _('cascade_opt_allowed_ips_hint') }}</span>
|
||||
</div>
|
||||
<div class="form-group" style="margin:0;">
|
||||
<label class="form-label" for="cascadeVpnSubnet">{{ _('cascade_opt_vpn_subnet') }}</label>
|
||||
<input type="text" class="form-input" id="cascadeVpnSubnet" placeholder="10.8.1.0/24" value="">
|
||||
<span class="form-hint">{{ _('cascade_opt_vpn_subnet_hint') }}</span>
|
||||
</div>
|
||||
</div>
|
||||
</details>
|
||||
|
||||
<div id="cascadeDiagBox" class="hidden" style="margin-bottom:var(--space-md); padding:var(--space-sm) var(--space-md); background:var(--bg-muted, rgba(0,0,0,.04)); border-radius:var(--radius-md); font-family:ui-monospace,monospace; font-size:12px; white-space:pre-wrap; max-height:160px; overflow:auto;"></div>
|
||||
|
||||
<div class="flex gap-sm" style="flex-wrap:wrap;">
|
||||
<button type="button" class="btn btn-primary" id="cascadeEnableBtn" onclick="enableCascade()">
|
||||
{{ _('cascade_enable') }}
|
||||
</button>
|
||||
<button type="button" class="btn btn-secondary" id="cascadeDisableBtn" onclick="disableCascade()">
|
||||
{{ _('cascade_disable') }}
|
||||
</button>
|
||||
<button type="button" class="btn btn-secondary" onclick="loadCascade()">{{ _('refresh') }}</button>
|
||||
</div>
|
||||
<div id="cascadeBusy" class="hidden" style="display:none; align-items:center; gap:var(--space-sm); margin-top:var(--space-md);">
|
||||
<div class="spinner" style="width:18px;height:18px;border-width:2px;"></div>
|
||||
<span id="cascadeBusyText">{{ _('cascade_working') }}</span>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
<!-- Installed Applications Section -->
|
||||
|
||||
<div class="apps-loading" id="installedAppsLoading">
|
||||
@@ -1429,6 +1576,7 @@
|
||||
}
|
||||
updateStatusCounts(data.protocols || {});
|
||||
showToast(_('server_check_complete'), 'success');
|
||||
loadCascade();
|
||||
} catch (err) {
|
||||
showToast(_('error') + ': ' + err.message, 'error');
|
||||
const statusDiv = document.getElementById('serverStatus');
|
||||
@@ -2965,8 +3113,182 @@
|
||||
}
|
||||
|
||||
|
||||
|
||||
// ========== Cascade (double VPN) ==========
|
||||
const CASCADE_PROTOS = ['awg2', 'awg', 'awg_legacy', 'wireguard'];
|
||||
|
||||
function fillCascadeExitProtocols() {
|
||||
const sel = document.getElementById('cascadeExitServer');
|
||||
const opt = sel.options[sel.selectedIndex];
|
||||
const protoSel = document.getElementById('cascadeExitProtocol');
|
||||
const raw = (opt && opt.dataset.protocols) ? opt.dataset.protocols.split(',').filter(Boolean) : [];
|
||||
const available = raw.filter(p => CASCADE_PROTOS.includes(protoBase(p)));
|
||||
const prev = protoSel.value;
|
||||
protoSel.innerHTML = '';
|
||||
const list = available.length ? available : CASCADE_PROTOS;
|
||||
list.forEach(p => {
|
||||
const o = document.createElement('option');
|
||||
o.value = p;
|
||||
o.textContent = getProtoTitle(p);
|
||||
protoSel.appendChild(o);
|
||||
});
|
||||
if (list.includes(prev)) protoSel.value = prev;
|
||||
else if (list.includes('awg2')) protoSel.value = 'awg2';
|
||||
}
|
||||
|
||||
function setCascadeBusy(on, text) {
|
||||
const busy = document.getElementById('cascadeBusy');
|
||||
const busyText = document.getElementById('cascadeBusyText');
|
||||
const en = document.getElementById('cascadeEnableBtn');
|
||||
const dis = document.getElementById('cascadeDisableBtn');
|
||||
if (busyText && text) busyText.textContent = text;
|
||||
if (busy) {
|
||||
busy.classList.toggle('hidden', !on);
|
||||
busy.style.display = on ? 'flex' : 'none';
|
||||
}
|
||||
if (en) en.disabled = !!on;
|
||||
if (dis) dis.disabled = !!on;
|
||||
}
|
||||
|
||||
function cascadeBool(id, fallback) {
|
||||
const el = document.getElementById(id);
|
||||
return el ? !!el.checked : !!fallback;
|
||||
}
|
||||
|
||||
function cascadeNum(id, fallback) {
|
||||
const el = document.getElementById(id);
|
||||
const n = el ? parseInt(el.value, 10) : NaN;
|
||||
return Number.isFinite(n) ? n : fallback;
|
||||
}
|
||||
|
||||
function collectCascadeSettings() {
|
||||
return {
|
||||
pin_exit_route: cascadeBool('cascadePinExitRoute', true),
|
||||
remove_eth_masquerade: cascadeBool('cascadeRemoveEthMasq', true),
|
||||
force_forward: cascadeBool('cascadeForceForward', true),
|
||||
mss_clamp: cascadeBool('cascadeMssClamp', true),
|
||||
wait_handshake: cascadeBool('cascadeWaitHandshake', true),
|
||||
verify_egress: cascadeBool('cascadeVerifyEgress', true),
|
||||
keep_exit_dns: cascadeBool('cascadeKeepExitDns', false),
|
||||
handshake_timeout_sec: cascadeNum('cascadeHandshakeTimeout', 25),
|
||||
table_id: cascadeNum('cascadeTableId', 200),
|
||||
rule_priority: cascadeNum('cascadeRulePriority', 100),
|
||||
allowed_ips: (document.getElementById('cascadeAllowedIps') || {}).value || '0.0.0.0/0',
|
||||
vpn_subnet_override: (document.getElementById('cascadeVpnSubnet') || {}).value || '',
|
||||
};
|
||||
}
|
||||
|
||||
function applyCascadeSettingsToForm(settings, defaults) {
|
||||
const s = Object.assign({}, defaults || {}, settings || {});
|
||||
const setCheck = (id, val) => { const el = document.getElementById(id); if (el) el.checked = !!val; };
|
||||
const setVal = (id, val) => { const el = document.getElementById(id); if (el && val !== undefined && val !== null) el.value = val; };
|
||||
setCheck('cascadePinExitRoute', s.pin_exit_route !== false);
|
||||
setCheck('cascadeRemoveEthMasq', s.remove_eth_masquerade !== false);
|
||||
setCheck('cascadeForceForward', s.force_forward !== false);
|
||||
setCheck('cascadeMssClamp', s.mss_clamp !== false);
|
||||
setCheck('cascadeWaitHandshake', s.wait_handshake !== false);
|
||||
setCheck('cascadeVerifyEgress', s.verify_egress !== false);
|
||||
setCheck('cascadeKeepExitDns', !!s.keep_exit_dns);
|
||||
setVal('cascadeHandshakeTimeout', s.handshake_timeout_sec ?? 25);
|
||||
setVal('cascadeTableId', s.table_id ?? 200);
|
||||
setVal('cascadeRulePriority', s.rule_priority ?? 100);
|
||||
setVal('cascadeAllowedIps', s.allowed_ips || '0.0.0.0/0');
|
||||
setVal('cascadeVpnSubnet', s.vpn_subnet_override || '');
|
||||
}
|
||||
|
||||
function updateCascadeDiag(cascade, live) {
|
||||
const box = document.getElementById('cascadeDiagBox');
|
||||
if (!box) return;
|
||||
const parts = [];
|
||||
if (cascade && cascade.enabled) {
|
||||
parts.push('handshake: ' + ((live && live.handshake) || cascade.handshake ? 'ok' : 'NONE'));
|
||||
if (cascade.diagnostics) parts.push(String(cascade.diagnostics).trim());
|
||||
else if (live && live.raw) parts.push(String(live.raw).trim());
|
||||
if (cascade.last_error) parts.push('error: ' + cascade.last_error);
|
||||
}
|
||||
const text = parts.filter(Boolean).join('\n\n');
|
||||
box.textContent = text;
|
||||
box.classList.toggle('hidden', !text);
|
||||
}
|
||||
|
||||
function updateCascadeBadge(cascade, live) {
|
||||
const badge = document.getElementById('cascadeStatusBadge');
|
||||
if (!badge) return;
|
||||
const enabled = !!(cascade && cascade.enabled);
|
||||
const up = !!(live && live.up);
|
||||
const hs = !!(live && live.handshake) || !!(cascade && cascade.handshake);
|
||||
badge.className = 'badge ' + (enabled && up && hs ? 'badge-success' : (enabled ? 'badge-warn' : 'badge-warn'));
|
||||
if (!enabled) badge.textContent = _('cascade_off');
|
||||
else if (up && hs) badge.textContent = _('cascade_on');
|
||||
else if (up && !hs) badge.textContent = _('cascade_no_handshake');
|
||||
else badge.textContent = _('cascade_configured_down');
|
||||
updateCascadeDiag(cascade, live);
|
||||
}
|
||||
|
||||
async function loadCascade() {
|
||||
try {
|
||||
const res = await apiCall(`/api/servers/${SERVER_ID}/cascade`, 'POST', {});
|
||||
const c = res.cascade || {};
|
||||
if (c.entry_protocol) document.getElementById('cascadeEntryProtocol').value = c.entry_protocol;
|
||||
if (c.exit_server_id !== undefined && c.exit_server_id !== null && c.exit_server_id !== '') {
|
||||
document.getElementById('cascadeExitServer').value = String(c.exit_server_id);
|
||||
fillCascadeExitProtocols();
|
||||
}
|
||||
if (c.exit_protocol) {
|
||||
const exitProto = document.getElementById('cascadeExitProtocol');
|
||||
if ([...exitProto.options].some(o => o.value === c.exit_protocol)) {
|
||||
exitProto.value = c.exit_protocol;
|
||||
}
|
||||
}
|
||||
applyCascadeSettingsToForm(c.settings || {}, res.defaults || {});
|
||||
updateCascadeBadge(c, res.live || {});
|
||||
} catch (err) {
|
||||
console.error(err);
|
||||
}
|
||||
}
|
||||
|
||||
async function setupCascade(enable) {
|
||||
const entryProtocol = document.getElementById('cascadeEntryProtocol').value;
|
||||
const exitServerId = document.getElementById('cascadeExitServer').value;
|
||||
const exitProtocol = document.getElementById('cascadeExitProtocol').value;
|
||||
if (enable && exitServerId === '') {
|
||||
showToast(_('cascade_exit_required'), 'error');
|
||||
return;
|
||||
}
|
||||
if (enable && !confirm(_('cascade_enable_confirm'))) return;
|
||||
if (!enable && !confirm(_('cascade_disable_confirm'))) return;
|
||||
|
||||
setCascadeBusy(true, enable ? _('cascade_working') : _('cascade_disabling'));
|
||||
showToast(enable ? _('cascade_working') : _('cascade_disabling'), 'info');
|
||||
try {
|
||||
const settings = collectCascadeSettings();
|
||||
const res = await apiCall(`/api/servers/${SERVER_ID}/cascade/setup`, 'POST', {
|
||||
enabled: !!enable,
|
||||
entry_protocol: entryProtocol,
|
||||
exit_server_id: parseInt(exitServerId || '0', 10),
|
||||
exit_protocol: exitProtocol,
|
||||
...settings,
|
||||
});
|
||||
updateCascadeBadge(res.cascade || {}, {
|
||||
up: !!(res.cascade && res.cascade.up),
|
||||
handshake: !!(res.cascade && res.cascade.handshake),
|
||||
});
|
||||
showToast(enable ? _('cascade_enabled') : _('cascade_disabled'), 'success');
|
||||
await loadCascade();
|
||||
} catch (err) {
|
||||
showToast(_('error') + ': ' + err.message, 'error');
|
||||
} finally {
|
||||
setCascadeBusy(false);
|
||||
}
|
||||
}
|
||||
|
||||
function enableCascade() { return setupCascade(true); }
|
||||
function disableCascade() { return setupCascade(false); }
|
||||
|
||||
// ========== Init ==========
|
||||
applyInstalledAppsVisibility();
|
||||
fillCascadeExitProtocols();
|
||||
loadCascade();
|
||||
checkServer();
|
||||
loadServerStats();
|
||||
</script>
|
||||
|
||||
Reference in New Issue
Block a user