Enable true one-click panel update from Settings (v2.5.1).

Download release ZIP from git.evilfox.cc when git is unavailable, add upgrade_panel API, and show a primary Update panel button.

README.md

@@ -1,6 +1,6 @@
 # Amnezia Web Panel
 
-A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Hysteria 2**, **NaiveProxy**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
+A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Hysteria 2**, **NaiveProxy**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **NordVPN**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
 
 > ### 🔄 Compatibility with Official Amnezia Client
 > 
@@ -66,6 +66,7 @@ Configuration panel for system parameters and preferences:
     *   **NaiveProxy** (stable): HTTPS/HTTP2 camouflage proxy via [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) (Caddy + [klzgrad/forwardproxy](https://github.com/klzgrad/forwardproxy) naïve fork). ACME TLS on the domain, per-client basic auth, `naive+https://` share links. Requires free TCP **80** and **443**. **Use Karing** as the client — do **not** use v2rayN; other clients are untested.
     *   **Telemt (Telegram MTProxy)**: High-performance Telegram MTProxy with TLS emulation and comprehensive management (quotas, IP limits, real-time session tracking). Robust install path that auto-configures Docker's official apt/yum repository when needed.
     *   **Cloudflare WARP**: Add and manage WARP-powered connectivity from the panel for routing and network flexibility.
+    *   **NordVPN**: Connect/disconnect outbound NordVPN from Settings via the official CLI (optional country/city).
 *   **🛠 Services**:
     *   **AmneziaDNS**: Internal DNS resolver on a private docker network (`amnezia-dns-net`, IP `172.29.172.254`) to prevent DNS leaks and blockings.
     *   **AdGuard Home**: DNS-based ad blocker with a web admin UI. Two install modes: **Replace AmneziaDNS** (takes its IP, all VPN clients use AdGuard immediately) or **Side-by-side** (parallel deployment on `172.29.172.253`, web UI accessible only over the VPN by default). Optional opt-in checkboxes to expose the web UI / DoT / DoH on the host.
@@ -79,17 +80,17 @@ Configuration panel for system parameters and preferences:
     *   **Reboot** the server directly from the UI.
     *   Strictly concurrent protocol status polling — all supported protocols/services checked in parallel for immediate feedback.
     *   **Asynchronous Processing**: Resilient, non-blocking background architecture prevents the UI panel from freezing, even if remote endpoints hang.
-*   **🔁 Cascade (double VPN)**:
-    *   Route clients through an **entry** AmneziaWG/WireGuard server to an **exit** server (country-block bypass).
-    *   Approach inspired by [ryderams/amneziawg-cascade](https://github.com/ryderams/amneziawg-cascade) (AWG2 entry→exit); applied via panel SSH — **no remote curl|bash** script download.
-    *   Handshake wait + optional egress verify (curl --interface → ifconfig.me); exit return route persisted like ryderams vps2.
-    *   Users keep using the **ENTRY** client config only — do not share the exit cascade peer.
 *   **🧩 Marketplace & Templates**:
     *   Market templates provide quick presets for installing and configuring supported protocols and services (including **Hysteria 2**).
     *   Multi-protocol management lets you run and control multiple protocol instances on the same server.
 *   **🌐 Internationalization (i18n)**:
     *   Full support for **English**, **Russian**, **French**, **Chinese**, and **Persian**.
     *   Native **RTL (Right-to-Left)** support for Persian language.
+*   **🔄 Auto-update**:
+    *   Settings → About checks releases on [git.evilfox.cc](https://git.evilfox.cc/test2/Amnezia-Web-Panel-main) and can install the latest tag via git + restart (when the panel runs from a git checkout).
+*   **🌍 Tunnels & outbound VPN**:
+    *   **Cloudflare Quick Tunnel** and **ngrok** expose the local panel to the internet.
+    *   **Cloudflare WARP** and **NordVPN** route the host outbound (no public panel URL).
 *   **👥 Advanced User Management**:
     *   Role-based access (Admin, Support, Regular User).
     *   Traffic limits, status monitoring, and account expiration.
@@ -227,15 +228,25 @@ GitHub Actions workflows in `.github/workflows/`:
 
 ## 📋 Fix / changelog (this fork)
 
+### v2.5.1
+*   **One-click panel update** — Settings → About → **Update panel**: downloads release ZIP from Gitea (or `git checkout` when `.git` exists), runs `pip install`, restarts.
+
+### v2.5.0
+*   **NordVPN in Tunnels** — connect/disconnect outbound NordVPN from Settings (official `nordvpn` CLI; optional country/city).
+
+### v2.4.0
+*   **Auto-update from Gitea**: Settings → About checks https://git.evilfox.cc/test2/Amnezia-Web-Panel-main releases and can install the latest tag via `git fetch` + checkout, then restart (git install only).
+
+### v2.3.0
+*   **Cascade removed** — double-VPN feature dropped from the panel (manager, API, UI, i18n).
+
 ### v2.2.1
 *   **Cascade egress verify fix**: bind curl to ENTRY `awg0`/`wg0` IP (client-subnet policy route), not cascade peer Address.
 *   Soft-warn (no rollback) when policy route via `cascade` is OK but public-IP echo services fail.
 
 ### v2.2.0
-*   **Cascade (double VPN) restored** — stable entry→exit tunnel for AmneziaWG / WireGuard.
-*   Inspired by [ryderams/amneziawg-cascade](https://github.com/ryderams/amneziawg-cascade); logic runs over panel SSH (**no remote curl|bash**).
-*   Safety: require exit **handshake** when enabled; optional **egress verify**; subnet conflict check; exit `/32` return route with start.sh markers.
-*   UI on the server page with per-step settings (pin exit route, MSS clamp, verify egress, …). Defaults prefer **awg2**.
+*   **Cascade (double VPN) restored** — later removed in **v2.3.0**.
+*   Inspired by [ryderams/amneziawg-cascade](https://github.com/ryderams/amneziawg-cascade); logic ran over panel SSH (**no remote curl|bash**).
 
 ### v2.1.0
 *   **NaiveProxy — stable**: production-ready install (Caddy + klzgrad/forwardproxy), share links always include `:443`.
@@ -268,7 +279,7 @@ GitHub Actions workflows in `.github/workflows/`:
 ### v1.6.0
 *   **3x-ui multi-panel**: register several 3x-ui servers in Settings; pick a panel and load VLESS inbounds over its API when creating users/invites (share link comes from 3x-ui).
 *   **Docker / CI**: refreshed `Dockerfile` + compose, `.env.example`, CI checks, GHCR image workflow.
-*   **Cascade** was temporarily removed in this release (redesigned and restored in **v2.2.0**).
+*   **Cascade** was temporarily removed in this release (briefly restored in v2.2.x, removed again in **v2.3.0**).
 *   **WG/AWG backups**: ZIP export of client `.conf` + restore with loading feedback.
 *   **API performance**: in-memory data cache, faster server check/stats.
 *   **Share / guest**: one-tap “Copy key”.

app.py

@@ -46,7 +46,7 @@ from managers.awg_manager import AWGManager
 from managers.xray_manager import XrayManager
 from managers.wireguard_manager import WireGuardManager
 from managers.backup_manager import BackupManager
-from managers.cascade_manager import CascadeManager, normalize_settings, DEFAULT_SETTINGS as CASCADE_DEFAULT_SETTINGS
+from managers.update_manager import UpdateManager, version_gt, api_latest_url, repo_url
 import telegram_bot as tg_bot
 
 # Configure logging
@@ -102,9 +102,9 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.2.1"
-RELEASES_REPO_URL = "https://git.evilfox.cc/test2/Amnezia-Web-Panel-main"
-RELEASES_API_LATEST = "https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest"
+CURRENT_VERSION = "v2.5.1"
+RELEASES_REPO_URL = repo_url()
+RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
 TUNNEL_STATE_FILE = os.environ.get('TUNNEL_STATE_FILE', os.path.join(application_path, 'tunnels_state.json'))
 
@@ -138,6 +138,7 @@ TUNNEL_RUNTIMES = {
 TUNNEL_LOCK = threading.Lock()
 TUNNEL_URL_RE = re.compile(r'https://[^\s"\']+')
 WARP_CLI_COMMAND = 'warp-cli.exe' if os.name == 'nt' else 'warp-cli'
+NORDVPN_CLI_COMMAND = 'nordvpn.exe' if os.name == 'nt' else 'nordvpn'
 
 
 
@@ -152,7 +153,7 @@ def load_translations():
             if f.endswith('.json'):
                 lang = f.split('.')[0]
                 try:
-                    with open(os.path.join(trans_dir, f), 'r', encoding='utf-8') as tf:
+                    with open(os.path.join(trans_dir, f), 'r', encoding='utf-8-sig') as tf:
                         TRANSLATIONS[lang] = json.load(tf)
                 except Exception as e:
                     logger.error(f"Error loading translation {f}: {e}")
@@ -373,6 +374,152 @@ def disable_warp():
     return get_warp_status()
 
 
+def get_nordvpn_cli_binary():
+    found = shutil.which(NORDVPN_CLI_COMMAND)
+    if found:
+        return found
+    if os.name == 'nt':
+        for base in (os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)')):
+            if not base:
+                continue
+            for sub in ('NordVPN', 'NordVPN NordSec'):
+                candidate = os.path.join(base, sub, 'nordvpn.exe')
+                if os.path.exists(candidate):
+                    return candidate
+    return None
+
+
+def is_nordvpn_cli_installed():
+    return bool(get_nordvpn_cli_binary())
+
+
+def _nordvpn_install_hint():
+    system = platform.system().lower()
+    if system == 'windows':
+        return (
+            'Install NordVPN from https://nordvpn.com/download/ or Microsoft Store, '
+            'then restart this panel.'
+        )
+    if system == 'darwin':
+        return 'Install NordVPN for macOS from https://nordvpn.com/download/, then restart this panel.'
+    return (
+        'Install NordVPN CLI: sh <(curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh), '
+        'add your user to the nordvpn group, run nordvpn login, then restart this panel.'
+    )
+
+
+def run_nordvpn_cli(*args, timeout: int = 30):
+    binary = get_nordvpn_cli_binary()
+    if not binary:
+        raise RuntimeError(_nordvpn_install_hint())
+    creationflags = subprocess.CREATE_NO_WINDOW if os.name == 'nt' else 0
+    result = subprocess.run(
+        [binary, *args],
+        capture_output=True,
+        text=True,
+        encoding='utf-8',
+        errors='replace',
+        timeout=timeout,
+        creationflags=creationflags,
+    )
+    output = '\n'.join(part.strip() for part in (result.stdout, result.stderr) if part and part.strip())
+    if result.returncode != 0:
+        raise RuntimeError(output or f'nordvpn exited with code {result.returncode}')
+    return output
+
+
+def _parse_nordvpn_status(output: str):
+    lowered = (output or '').lower()
+    if 'not logged in' in lowered or 'login required' in lowered or 'please log in' in lowered:
+        return 'not_logged_in'
+    if 'disconnected' in lowered:
+        return 'disconnected'
+    if 'connecting' in lowered:
+        return 'connecting'
+    if 'connected' in lowered:
+        return 'connected'
+    if 'daemon' in lowered or 'nordvpnd' in lowered:
+        return 'service_unavailable'
+    return 'unknown'
+
+
+def _nordvpn_server_line(output: str) -> str:
+    for line in (output or '').splitlines():
+        stripped = line.strip()
+        if not stripped:
+            continue
+        low = stripped.lower()
+        if low.startswith('server:') or low.startswith('country:') or low.startswith('your new ip:'):
+            return stripped
+    return ''
+
+
+def get_nordvpn_status():
+    installed = is_nordvpn_cli_installed()
+    status = {
+        'installed': installed,
+        'running': False,
+        'connected': False,
+        'status': 'not_installed' if not installed else 'unknown',
+        'server': '',
+        'raw': '',
+        'last_error': '' if installed else _nordvpn_install_hint(),
+        'install_hint': _nordvpn_install_hint(),
+    }
+    if not installed:
+        return status
+    try:
+        output = run_nordvpn_cli('status', timeout=15)
+        parsed = _parse_nordvpn_status(output)
+        status.update({
+            'running': parsed in ('connected', 'connecting'),
+            'connected': parsed == 'connected',
+            'status': parsed,
+            'server': _nordvpn_server_line(output),
+            'raw': output,
+            'last_error': '',
+        })
+    except Exception as e:
+        status['last_error'] = str(e)
+        lowered = str(e).lower()
+        if 'not logged in' in lowered or 'login' in lowered:
+            status['status'] = 'not_logged_in'
+        elif 'daemon' in lowered or 'nordvpnd' in lowered or 'service' in lowered or 'permission' in lowered:
+            status['status'] = 'service_unavailable'
+        else:
+            status['status'] = 'error'
+    return status
+
+
+def enable_nordvpn(country: str = '', city: str = ''):
+    current = get_nordvpn_status()
+    if not current.get('installed'):
+        raise RuntimeError(current.get('install_hint') or _nordvpn_install_hint())
+    if current.get('status') == 'not_logged_in':
+        raise RuntimeError(
+            'NordVPN is not logged in. Run `nordvpn login` on this host (browser flow), then retry.'
+        )
+    args = ['connect']
+    country = (country or '').strip()
+    city = (city or '').strip()
+    if country and city:
+        args.extend([country, city])
+    elif country:
+        args.append(country)
+    run_nordvpn_cli(*args, timeout=45)
+    time.sleep(1)
+    return get_nordvpn_status()
+
+
+def disable_nordvpn():
+    current = get_nordvpn_status()
+    if not current.get('installed'):
+        raise RuntimeError(current.get('install_hint') or _nordvpn_install_hint())
+    run_nordvpn_cli('disconnect', timeout=30)
+    time.sleep(0.5)
+    return get_nordvpn_status()
+
+
 def get_tunnel_command_name(provider: str):
     if provider == 'cloudflare':
         return 'cloudflared.exe' if os.name == 'nt' else 'cloudflared'
@@ -1743,25 +1890,6 @@ class HysteriaSettingsRequest(BaseModel):
     email: Optional[str] = None
     renew_ssl: bool = False
 
-class CascadeSetupRequest(BaseModel):
-    entry_protocol: str = 'awg2'
-    exit_server_id: Optional[int] = None
-    exit_protocol: str = 'awg2'
-    enabled: bool = True
-    # Per-step cascade tuning
-    pin_exit_route: Optional[bool] = True
-    remove_eth_masquerade: Optional[bool] = True
-    force_forward: Optional[bool] = True
-    mss_clamp: Optional[bool] = True
-    wait_handshake: Optional[bool] = True
-    handshake_timeout_sec: Optional[int] = 25
-    allowed_ips: Optional[str] = '0.0.0.0/0'
-    keep_exit_dns: Optional[bool] = False
-    vpn_subnet_override: Optional[str] = ''
-    table_id: Optional[int] = 200
-    rule_priority: Optional[int] = 100
-    verify_egress: Optional[bool] = True
-
 class ProtocolRequest(BaseModel):
     protocol: str = 'awg'
 
@@ -2012,6 +2140,16 @@ class TunnelStartRequest(BaseModel):
     authtoken: Optional[str] = None
 
 
+class ApplyUpdateRequest(BaseModel):
+    target_version: Optional[str] = None
+    allow_dirty: bool = False
+
+
+class NordvpnConnectRequest(BaseModel):
+    country: Optional[str] = ''
+    city: Optional[str] = ''
+
+
 # ======================== Startup ========================
 
 @app.on_event("startup")
@@ -2319,7 +2457,7 @@ async def server_detail(request: Request, server_id: int):
         return RedirectResponse(url='/')
     server = data['servers'][server_id]
     users_list = data.get('users', [])
-    return tpl(request, 'server.html', server=server, server_id=server_id, users=users_list, all_servers=data['servers'])
+    return tpl(request, 'server.html', server=server, server_id=server_id, users=users_list)
 
 
 @app.get('/users', response_class=HTMLResponse, tags=["System Templates"])
@@ -3250,243 +3388,6 @@ async def api_hysteria_update_settings(request: Request, server_id: int, req: Hy
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
-@app.post('/api/servers/{server_id}/cascade', tags=["Protocols"])
-async def api_cascade_get(request: Request, server_id: int):
-    """Return saved cascade settings and live tunnel status for this (entry) server."""
-    if not _check_admin(request):
-        return JSONResponse({'error': 'Forbidden'}, status_code=403)
-    try:
-        data = await asyncio.to_thread(load_data)
-        if server_id >= len(data['servers']):
-            return JSONResponse({'error': 'Server not found'}, status_code=404)
-        server = data['servers'][server_id]
-        cascade = dict(server.get('cascade') or {})
-        live = {'enabled': False, 'up': False}
-        entry_proto = cascade.get('entry_protocol') or ''
-        if cascade.get('enabled') and entry_proto and CascadeManager.is_wg_family(entry_proto):
-            def _status():
-                ssh = get_ssh(server)
-                ssh.connect()
-                try:
-                    return CascadeManager(ssh).status(entry_proto)
-                finally:
-                    ssh.disconnect()
-            live = await asyncio.to_thread(_status)
-        return {
-            'cascade': cascade,
-            'live': live,
-            'defaults': CASCADE_DEFAULT_SETTINGS,
-            'servers': [
-                {
-                    'id': i,
-                    'name': s.get('name') or s.get('host'),
-                    'host': s.get('host'),
-                    'protocols': list((s.get('protocols') or {}).keys()),
-                }
-                for i, s in enumerate(data['servers']) if i != server_id
-            ],
-        }
-    except Exception as e:
-        logger.exception("Error reading cascade status")
-        return JSONResponse({'error': str(e)}, status_code=500)
-
-
-@app.post('/api/servers/{server_id}/cascade/setup', tags=["Protocols"])
-async def api_cascade_setup(request: Request, server_id: int, req: CascadeSetupRequest):
-    """Enable or disable double-VPN cascade: clients → this entry → exit server."""
-    if not _check_admin(request):
-        return JSONResponse({'error': 'Forbidden'}, status_code=403)
-    if not CascadeManager.is_wg_family(req.entry_protocol):
-        return JSONResponse({'error': 'Cascade supports WireGuard / AmneziaWG only'}, status_code=400)
-    if req.enabled and not CascadeManager.is_wg_family(req.exit_protocol):
-        return JSONResponse({'error': 'Cascade supports WireGuard / AmneziaWG only'}, status_code=400)
-
-    try:
-        data = await asyncio.to_thread(load_data)
-        if server_id >= len(data['servers']):
-            return JSONResponse({'error': 'Server not found'}, status_code=404)
-        entry = data['servers'][server_id]
-        settings = normalize_settings({
-            'pin_exit_route': req.pin_exit_route,
-            'remove_eth_masquerade': req.remove_eth_masquerade,
-            'force_forward': req.force_forward,
-            'mss_clamp': req.mss_clamp,
-            'wait_handshake': req.wait_handshake,
-            'handshake_timeout_sec': req.handshake_timeout_sec,
-            'allowed_ips': req.allowed_ips,
-            'keep_exit_dns': req.keep_exit_dns,
-            'vpn_subnet_override': req.vpn_subnet_override,
-            'table_id': req.table_id,
-            'rule_priority': req.rule_priority,
-            'verify_egress': req.verify_egress,
-        })
-        if not req.enabled:
-            def _disable():
-                ssh = get_ssh(entry)
-                ssh.connect()
-                try:
-                    return CascadeManager(ssh).disable(
-                        req.entry_protocol,
-                        settings=dict((entry.get('cascade') or {}).get('settings') or settings),
-                    )
-                finally:
-                    ssh.disconnect()
-
-            result = await asyncio.to_thread(_disable)
-            if result.get('status') == 'error':
-                return JSONResponse({'error': result.get('message', 'Failed to disable cascade')}, status_code=500)
-            prev = dict(entry.get('cascade') or {})
-            entry['cascade'] = {
-                'enabled': False,
-                'entry_protocol': req.entry_protocol or prev.get('entry_protocol'),
-                'exit_server_id': prev.get('exit_server_id'),
-                'exit_protocol': prev.get('exit_protocol') or req.exit_protocol,
-                'settings': settings,
-                'updated_at': datetime.now().isoformat(timespec='seconds'),
-            }
-            async with DATA_LOCK:
-                await asyncio.to_thread(save_data, data)
-            return {'status': 'success', 'cascade': entry['cascade']}
-
-        if req.exit_server_id is None:
-            return JSONResponse({'error': 'exit_server_id is required'}, status_code=400)
-        if req.exit_server_id < 0 or req.exit_server_id >= len(data['servers']):
-            return JSONResponse({'error': 'Exit server not found'}, status_code=404)
-        if req.exit_server_id == server_id:
-            return JSONResponse({'error': 'Entry and exit servers must be different'}, status_code=400)
-
-        exit_srv = data['servers'][req.exit_server_id]
-
-        def _enable():
-            exit_ssh = get_ssh(exit_srv)
-            exit_ssh.connect()
-            try:
-                exit_mgr = get_protocol_manager(exit_ssh, req.exit_protocol)
-                clients = _manager_call(exit_mgr, 'get_clients', req.exit_protocol) or []
-                cascade_name = f"cascade-from-{(entry.get('name') or entry.get('host') or 'entry')[:40]}"
-                cascade_name = re.sub(r'[^\w.\-]+', '_', cascade_name).strip('._') or 'cascade-entry'
-                existing = None
-                for c in clients:
-                    ud = c.get('userData') or {}
-                    if ud.get('clientName') == cascade_name or ud.get('cascade_entry_server_id') == server_id:
-                        existing = c
-                        break
-
-                if existing:
-                    client_id = existing.get('clientId')
-                    conf = _manager_call(
-                        exit_mgr, 'get_client_config', req.exit_protocol,
-                        client_id, exit_srv['host'],
-                        (exit_srv.get('protocols') or {}).get(req.exit_protocol, {}).get('port', '55424'),
-                    )
-                else:
-                    add_res = _manager_call(
-                        exit_mgr, 'add_client', req.exit_protocol, cascade_name,
-                        exit_srv['host'],
-                        (exit_srv.get('protocols') or {}).get(req.exit_protocol, {}).get('port', '55424'),
-                    )
-                    if not add_res.get('client_id'):
-                        raise RuntimeError(add_res.get('message') or 'Failed to create cascade peer on exit')
-                    client_id = add_res['client_id']
-                    conf = add_res.get('config')
-                    if not conf:
-                        conf = _manager_call(
-                            exit_mgr, 'get_client_config', req.exit_protocol,
-                            client_id, exit_srv['host'],
-                            (exit_srv.get('protocols') or {}).get(req.exit_protocol, {}).get('port', '55424'),
-                        )
-                    try:
-                        table = exit_mgr._get_clients_table(req.exit_protocol) if hasattr(exit_mgr, '_get_clients_table') else []
-                        for row in table:
-                            if row.get('clientId') == client_id:
-                                row.setdefault('userData', {})['cascade_entry_server_id'] = server_id
-                                if hasattr(exit_mgr, '_save_clients_table'):
-                                    exit_mgr._save_clients_table(req.exit_protocol, table)
-                                break
-                    except Exception:
-                        pass
-            finally:
-                exit_ssh.disconnect()
-
-            entry_ssh = get_ssh(entry)
-            entry_ssh.connect()
-            try:
-                applied = CascadeManager(entry_ssh).apply(
-                    req.entry_protocol,
-                    conf,
-                    exit_srv.get('host') or '',
-                    settings=settings,
-                )
-            finally:
-                entry_ssh.disconnect()
-
-            if applied.get('status') != 'success':
-                raise RuntimeError(applied.get('message') or 'Failed to apply cascade on entry')
-
-            if settings.get('wait_handshake') and not applied.get('handshake'):
-                try:
-                    entry_ssh2 = get_ssh(entry)
-                    entry_ssh2.connect()
-                    try:
-                        CascadeManager(entry_ssh2).disable(req.entry_protocol, settings=settings)
-                    finally:
-                        entry_ssh2.disconnect()
-                except Exception:
-                    pass
-                raise RuntimeError(
-                    applied.get('message')
-                    or 'Cascade apply reported success but exit handshake is missing'
-                )
-
-            peer_ip = applied.get('cascade_peer_ip') or ''
-            if not peer_ip and conf:
-                peer_ip = CascadeManager._extract_address_ip(conf)
-            if peer_ip and hasattr(CascadeManager, 'ensure_exit_return_route'):
-                exit_ssh2 = get_ssh(exit_srv)
-                exit_ssh2.connect()
-                try:
-                    route_res = CascadeManager(exit_ssh2).ensure_exit_return_route(
-                        req.exit_protocol, peer_ip
-                    )
-                    applied['exit_return_route'] = route_res
-                finally:
-                    exit_ssh2.disconnect()
-
-            return {
-                'client_id': client_id,
-                'client_name': cascade_name,
-                'applied': applied,
-            }
-
-        info = await asyncio.to_thread(_enable)
-        applied = info.get('applied') or {}
-        entry['cascade'] = {
-            'enabled': True,
-            'entry_protocol': req.entry_protocol,
-            'exit_server_id': req.exit_server_id,
-            'exit_protocol': req.exit_protocol,
-            'exit_client_id': info['client_id'],
-            'exit_client_name': info['client_name'],
-            'settings': settings,
-            'up': bool(applied.get('up')),
-            'handshake': bool(applied.get('handshake')),
-            'updated_at': datetime.now().isoformat(timespec='seconds'),
-            'last_error': None,
-            'diagnostics': applied.get('diagnostics') or '',
-        }
-        async with DATA_LOCK:
-            await asyncio.to_thread(save_data, data)
-        return {
-            'status': 'success',
-            'cascade': entry['cascade'],
-            'applied': applied,
-            'warning': applied.get('warning'),
-        }
-    except Exception as e:
-        logger.exception("Error setting up cascade")
-        return JSONResponse({'error': str(e)}, status_code=500)
-
-
 
 @app.post('/api/servers/{server_id}/uninstall', tags=["Protocols"])
 async def api_uninstall_protocol(request: Request, server_id: int, req: ProtocolRequest):
@@ -5755,6 +5656,8 @@ async def api_check_updates(request: Request):
     if not _check_admin(request):
         return JSONResponse({'error': 'Forbidden'}, status_code=403)
     try:
+        updater = UpdateManager(application_path, CURRENT_VERSION)
+        mode = updater.detect_mode()
         async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
             resp = await client.get(
                 RELEASES_API_LATEST,
@@ -5768,20 +5671,104 @@ async def api_check_updates(request: Request):
         data = resp.json() if resp.content else {}
         latest = (data.get('tag_name') or data.get('name') or '').strip()
         html_url = (data.get('html_url') or f'{RELEASES_REPO_URL}/releases').strip()
+        body = (data.get('body') or '')[:4000]
         current = CURRENT_VERSION
-        update_available = bool(latest) and latest != current
+        update_available = bool(latest) and version_gt(latest, current)
         return {
             'current_version': current,
             'latest_version': latest,
             'update_available': update_available,
             'html_url': html_url,
             'releases_url': f'{RELEASES_REPO_URL}/releases',
+            'body': body,
+            'can_auto_update': bool(mode.get('can_auto_update')),
+            'update_mode': mode.get('update_method') or mode.get('mode'),
+            'mode': mode,
         }
     except Exception as e:
         logger.exception('Error checking for updates')
         return JSONResponse({'error': str(e)}, status_code=502)
 
 
+async def _fetch_latest_release_tag() -> str:
+    async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+        resp = await client.get(RELEASES_API_LATEST, headers={'Accept': 'application/json'})
+    if resp.status_code >= 400:
+        raise RuntimeError(f'Release API returned HTTP {resp.status_code}')
+    data = resp.json() if resp.content else {}
+    return (data.get('tag_name') or data.get('name') or '').strip()
+
+
+@app.post('/api/settings/apply_update', tags=["Settings"])
+async def api_apply_update(request: Request, req: ApplyUpdateRequest):
+    """Install a release tag (git checkout or archive download) and restart the panel."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    updater = UpdateManager(application_path, CURRENT_VERSION)
+    target = (req.target_version or '').strip()
+    if not target:
+        try:
+            target = await _fetch_latest_release_tag()
+        except Exception as e:
+            logger.exception('Failed to resolve latest tag for apply_update')
+            return JSONResponse({'error': str(e)}, status_code=502)
+    if not target:
+        return JSONResponse({'error': 'No target version specified'}, status_code=400)
+
+    result = await asyncio.to_thread(
+        updater.apply_update,
+        target,
+        bool(req.allow_dirty),
+    )
+    if result.get('status') != 'success':
+        status_code = 409 if result.get('needs_confirm_dirty') else 500
+        return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=status_code)
+
+    if result.get('restart'):
+        UpdateManager.schedule_restart(1.5)
+    return result
+
+
+@app.post('/api/settings/upgrade_panel', tags=["Settings"])
+async def api_upgrade_panel(request: Request):
+    """One-click: fetch latest release, install if newer, restart."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    updater = UpdateManager(application_path, CURRENT_VERSION)
+    mode = updater.detect_mode()
+    if not mode.get('can_auto_update'):
+        return JSONResponse({
+            'error': (
+                'In-panel update is not available for this install. '
+                'Use git clone / writable app directory, or rebuild Docker on the host.'
+            ),
+            'mode': mode,
+        }, status_code=400)
+    try:
+        latest = await _fetch_latest_release_tag()
+    except Exception as e:
+        return JSONResponse({'error': str(e)}, status_code=502)
+    if not latest:
+        return JSONResponse({'error': 'Could not resolve latest release tag'}, status_code=502)
+    if not version_gt(latest, CURRENT_VERSION):
+        return {
+            'status': 'success',
+            'up_to_date': True,
+            'current_version': CURRENT_VERSION,
+            'latest_version': latest,
+            'message': 'Already on the latest version',
+        }
+
+    result = await asyncio.to_thread(updater.apply_update, latest, True)
+    if result.get('status') != 'success':
+        return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=500)
+    if result.get('restart'):
+        UpdateManager.schedule_restart(1.5)
+    result['up_to_date'] = False
+    result['previous_version'] = CURRENT_VERSION
+    return result
+
+
 @app.get('/api/settings/tunnels/status', tags=["Settings"])
 async def api_tunnels_status(request: Request):
     if not _check_admin(request):
@@ -5791,6 +5778,7 @@ async def api_tunnels_status(request: Request):
         'cloudflare': get_tunnel_status('cloudflare'),
         'ngrok': get_tunnel_status('ngrok'),
         'warp': get_warp_status(),
+        'nordvpn': get_nordvpn_status(),
     }
 
 
@@ -5876,6 +5864,28 @@ async def api_warp_disconnect(request: Request):
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+@app.post('/api/settings/nordvpn/connect', tags=["Settings"])
+async def api_nordvpn_connect(request: Request, req: NordvpnConnectRequest = NordvpnConnectRequest()):
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        return await asyncio.to_thread(enable_nordvpn, req.country or '', req.city or '')
+    except Exception as e:
+        logger.exception("Error connecting NordVPN")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
+@app.post('/api/settings/nordvpn/disconnect', tags=["Settings"])
+async def api_nordvpn_disconnect(request: Request):
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        return await asyncio.to_thread(disable_nordvpn)
+    except Exception as e:
+        logger.exception("Error disconnecting NordVPN")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
 # @app.post('/api/settings/save')
 # async def api_save_settings(request: Request, body: SaveSettingsRequest):
 #     _check_admin(request)

managers/cascade_manager.py

@@ -1,733 +0,0 @@
-"""Cascade (double-VPN) between two panel-managed WireGuard/AWG servers.
-
-Traffic path:
-  Clients → Entry server (accessible) → Exit server (blocked / target) → Internet
-
-Implemented inside the entry Docker container as a second AWG/WG interface
-(`cascade.conf`) with source-based routing for the VPN client subnet.
-
-Inspired by ryderams/amneziawg-cascade (AWG2 entry→exit), but executed via the
-panel SSH session — no remote curl|bash script download.
-"""
-
-from __future__ import annotations
-
-import ipaddress
-import re
-import shlex
-from datetime import datetime
-from typing import Optional
-
-
-WG_FAMILY = {'awg', 'awg2', 'awg_legacy', 'wireguard'}
-CASCADE_MARKER = '# amnezia-web-panel-cascade'
-EXIT_ROUTE_BEGIN = '# BEGIN awg-cascade-vps2'
-EXIT_ROUTE_END = '# END awg-cascade-vps2'
-
-DEFAULT_SETTINGS = {
-    'pin_exit_route': True,
-    'remove_eth_masquerade': True,
-    'force_forward': True,
-    'mss_clamp': True,
-    'wait_handshake': True,
-    'handshake_timeout_sec': 25,
-    'allowed_ips': '0.0.0.0/0',
-    'keep_exit_dns': False,
-    'vpn_subnet_override': '',
-    'table_id': 200,
-    'rule_priority': 100,
-    'verify_egress': True,
-}
-
-
-def normalize_settings(raw: Optional[dict]) -> dict:
-    settings = dict(DEFAULT_SETTINGS)
-    if isinstance(raw, dict):
-        for key, default in DEFAULT_SETTINGS.items():
-            if key not in raw or raw[key] is None:
-                continue
-            if isinstance(default, bool):
-                settings[key] = bool(raw[key])
-            elif isinstance(default, int):
-                try:
-                    settings[key] = int(raw[key])
-                except (TypeError, ValueError):
-                    settings[key] = default
-            else:
-                settings[key] = str(raw[key]).strip()
-    settings['handshake_timeout_sec'] = max(5, min(120, int(settings['handshake_timeout_sec'])))
-    settings['table_id'] = max(1, min(252, int(settings['table_id'])))
-    settings['rule_priority'] = max(1, min(32765, int(settings['rule_priority'])))
-    if not settings.get('allowed_ips'):
-        settings['allowed_ips'] = DEFAULT_SETTINGS['allowed_ips']
-    return settings
-
-
-class CascadeManager:
-    def __init__(self, ssh_manager):
-        self.ssh = ssh_manager
-
-    @staticmethod
-    def proto_base(protocol: str) -> str:
-        return str(protocol or '').split('__', 1)[0]
-
-    @staticmethod
-    def is_wg_family(protocol: str) -> bool:
-        return CascadeManager.proto_base(protocol) in WG_FAMILY
-
-    @staticmethod
-    def _container_name(protocol: str) -> str:
-        base = CascadeManager.proto_base(protocol)
-        match = re.search(r'__(\d+)$', str(protocol or ''))
-        idx = int(match.group(1)) if match else 1
-        names = {
-            'awg': 'amnezia-awg',
-            'awg2': 'amnezia-awg2',
-            'awg_legacy': 'amnezia-awg-legacy',
-            'wireguard': 'amnezia-wireguard',
-        }
-        name = names.get(base)
-        if not name:
-            return ''
-        return name if idx <= 1 else f'{name}-{idx}'
-
-    @staticmethod
-    def _wg_binary(protocol: str) -> str:
-        return 'wg' if CascadeManager.proto_base(protocol) in ('awg_legacy', 'wireguard') else 'awg'
-
-    @staticmethod
-    def _quick_binary(protocol: str) -> str:
-        return 'wg-quick' if CascadeManager.proto_base(protocol) in ('awg_legacy', 'wireguard') else 'awg-quick'
-
-    @staticmethod
-    def _conf_dir(protocol: str) -> str:
-        return '/opt/amnezia/wireguard' if CascadeManager.proto_base(protocol) == 'wireguard' else '/opt/amnezia/awg'
-
-    @classmethod
-    def _cascade_conf(cls, protocol: str) -> str:
-        return f'{cls._conf_dir(protocol)}/cascade.conf'
-
-    @classmethod
-    def _cascade_up(cls, protocol: str) -> str:
-        return f'{cls._conf_dir(protocol)}/cascade-up.sh'
-
-    @staticmethod
-    def _server_conf(protocol: str) -> str:
-        base = CascadeManager.proto_base(protocol)
-        if base == 'wireguard':
-            return '/opt/amnezia/wireguard/wg0.conf'
-        if base == 'awg_legacy':
-            return '/opt/amnezia/awg/wg0.conf'
-        return '/opt/amnezia/awg/awg0.conf'
-
-    @staticmethod
-    def _server_iface(protocol: str) -> str:
-        base = CascadeManager.proto_base(protocol)
-        if base in ('wireguard', 'awg_legacy'):
-            return 'wg0'
-        return 'awg0'
-
-    @staticmethod
-    def _extract_endpoint_host(config_text: str) -> str:
-        for line in (config_text or '').splitlines():
-            if line.strip().lower().startswith('endpoint'):
-                rhs = line.split('=', 1)[-1].strip()
-                return rhs.rsplit(':', 1)[0].strip().strip('[]')
-        return ''
-
-    @staticmethod
-    def _extract_address_cidr(config_text: str) -> str:
-        for line in (config_text or '').splitlines():
-            stripped = line.strip()
-            if stripped.lower().startswith('address'):
-                rhs = stripped.split('=', 1)[-1].strip()
-                return rhs.split(',')[0].strip()
-        return ''
-
-    @staticmethod
-    def _extract_address_ip(config_text: str) -> str:
-        cidr = CascadeManager._extract_address_cidr(config_text)
-        if not cidr:
-            return ''
-        return cidr.split('/', 1)[0].strip()
-
-    @staticmethod
-    def prepare_exit_client_config(
-        raw_config: str,
-        endpoint_host: str,
-        *,
-        keep_dns: bool = False,
-        allowed_ips: str = '0.0.0.0/0',
-    ) -> str:
-        """Adapt a normal client config for use as an entry→exit cascade tunnel."""
-        effective_allowed = (allowed_ips or '').strip() or '0.0.0.0/0'
-        if effective_allowed in ('0.0.0.0/0, ::/0', '::/0, 0.0.0.0/0'):
-            effective_allowed = '0.0.0.0/0'
-
-        lines = []
-        in_interface = False
-        in_peer = False
-        has_table = False
-        has_mtu = False
-        for raw in (raw_config or '').splitlines():
-            stripped = raw.strip()
-            lower = stripped.lower()
-            if stripped.startswith('[') and stripped.endswith(']'):
-                in_interface = stripped.lower() == '[interface]'
-                in_peer = stripped.lower() == '[peer]'
-                lines.append(stripped)
-                continue
-            if in_interface and lower.startswith('dns') and not keep_dns:
-                continue
-            if in_interface and lower.startswith('table'):
-                has_table = True
-                lines.append('Table = off')
-                continue
-            if in_interface and lower.startswith('mtu'):
-                has_mtu = True
-                lines.append(stripped)
-                continue
-            if lower.startswith('endpoint'):
-                port = '51820'
-                if '=' in stripped:
-                    rhs = stripped.split('=', 1)[1].strip()
-                    if ':' in rhs:
-                        port = rhs.rsplit(':', 1)[-1]
-                host = (endpoint_host or '').strip()
-                if host:
-                    lines.append(f'Endpoint = {host}:{port}')
-                else:
-                    lines.append(stripped)
-                continue
-            if in_peer and lower.startswith('allowedips'):
-                lines.append(f'AllowedIPs = {effective_allowed}')
-                continue
-            lines.append(stripped)
-
-        out = []
-        inserted_iface = False
-        for line in lines:
-            out.append(line)
-            if not inserted_iface and line.strip().lower() == '[interface]':
-                if not has_table:
-                    out.append('Table = off')
-                if not has_mtu:
-                    out.append('MTU = 1280')
-                inserted_iface = True
-        return '\n'.join(out).strip() + '\n'
-
-    @staticmethod
-    def _subnet_contains_ip(subnet: str, ip: str) -> bool:
-        try:
-            net = ipaddress.ip_network(subnet, strict=False)
-            return ipaddress.ip_address(ip) in net
-        except ValueError:
-            return False
-
-    def status(self, entry_protocol: str) -> dict:
-        container = self._container_name(entry_protocol)
-        if not container:
-            return {'enabled': False, 'up': False, 'handshake': False, 'error': 'Unsupported protocol'}
-        conf = self._cascade_conf(entry_protocol)
-        wg_bin = self._wg_binary(entry_protocol)
-        out, _, _ = self.ssh.run_sudo_command(
-            f"docker exec {shlex.quote(container)} bash -lc "
-            f"'echo HAS=$(test -f {shlex.quote(conf)} && echo 1 || echo 0); "
-            f"echo IFACES=$({wg_bin} show interfaces 2>/dev/null); "
-            f"echo HANDSHAKE=$({wg_bin} show cascade latest-handshakes 2>/dev/null | awk \"{{print \\$2}}\" | head -1); "
-            f"echo TRANSFER=$({wg_bin} show cascade transfer 2>/dev/null | head -1); "
-            f"ip rule show 2>/dev/null | head -20; "
-            f"ip route show table 200 2>/dev/null | head -10'"
-        )
-        text = out or ''
-        has_conf = 'HAS=1' in text
-        ifaces_line = ''
-        handshake_ts = 0
-        for line in text.splitlines():
-            if line.startswith('IFACES='):
-                ifaces_line = line.split('=', 1)[1].strip()
-            if line.startswith('HANDSHAKE='):
-                try:
-                    handshake_ts = int(line.split('=', 1)[1].strip() or '0')
-                except ValueError:
-                    handshake_ts = 0
-        up = 'cascade' in ifaces_line.split()
-        handshake_ok = handshake_ts > 0
-        return {
-            'enabled': has_conf,
-            'up': up,
-            'handshake': handshake_ok,
-            'handshake_ts': handshake_ts,
-            'raw': text.strip()[:3000],
-        }
-
-    def _vpn_server_iface(self, entry_protocol: str) -> str:
-        base = self.proto_base(entry_protocol)
-        if base in ('awg_legacy', 'wireguard'):
-            return 'wg0'
-        return 'awg0'
-
-    def _vpn_server_ip(self, entry_protocol: str, container: str) -> str:
-        """IPv4 on awg0/wg0 — traffic from this IP is policy-routed through cascade."""
-        iface = self._vpn_server_iface(entry_protocol)
-        out, _, _ = self.ssh.run_sudo_command(
-            f"docker exec {shlex.quote(container)} sh -c "
-            f"{shlex.quote(f'ip -o -4 addr show dev {iface} 2>/dev/null')}",
-            timeout=15,
-        )
-        for line in (out or '').splitlines():
-            m = re.search(r'\binet\s+(\d+\.\d+\.\d+\.\d+)/\d+', line)
-            if m:
-                return m.group(1)
-        return ''
-
-    @staticmethod
-    def _parse_public_ipv4(text: str) -> str:
-        raw = (text or '').strip()
-        if not raw:
-            return ''
-        for line in reversed(raw.splitlines()):
-            line = line.strip()
-            if re.fullmatch(r'\d+\.\d+\.\d+\.\d+', line):
-                return line
-        m = re.search(r'\b(\d{1,3}(?:\.\d{1,3}){3})\b', raw)
-        return m.group(1) if m else ''
-
-    def _verify_egress(self, container: str, entry_protocol: str, subnet: str) -> dict:
-        """Confirm client-subnet traffic exits via cascade (ryderams-style).
-
-        Bind curl to the VPN server IP on awg0/wg0 (NOT the cascade peer Address).
-        Policy routing only applies to the client subnet — cascade Address must
-        not be used as --interface.
-        """
-        server_ip = self._vpn_server_ip(entry_protocol, container)
-        iface = self._vpn_server_iface(entry_protocol)
-        if not server_ip:
-            return {
-                'ok': False,
-                'skipped': False,
-                'detail': f'Could not read IPv4 on {iface} for egress verify',
-                'bind': '',
-            }
-
-        route_out, _, _ = self.ssh.run_sudo_command(
-            f"docker exec {shlex.quote(container)} sh -c "
-            f"{shlex.quote(f'ip route get 1.1.1.1 from {server_ip} 2>/dev/null | head -1')}",
-            timeout=15,
-        )
-        route_line = (route_out or '').strip()
-        route_via_cascade = bool(re.search(r'\bdev\s+cascade\b', route_line))
-
-        if not route_via_cascade:
-            return {
-                'ok': False,
-                'skipped': False,
-                'detail': (
-                    f'Policy route from {server_ip} does not use cascade iface. '
-                    f'Got: {route_line or "empty"}'
-                ),
-                'bind': server_ip,
-                'route': route_line,
-                'subnet': subnet,
-            }
-
-        has_curl, _, _ = self.ssh.run_sudo_command(
-            f"docker exec {shlex.quote(container)} sh -c "
-            f"{shlex.quote('command -v curl >/dev/null 2>&1 && echo YES')}",
-            timeout=15,
-        )
-        if 'YES' not in (has_curl or ''):
-            return {
-                'ok': True,
-                'skipped': True,
-                'warning': True,
-                'detail': 'curl not installed in container — egress IP check skipped (policy route OK)',
-                'bind': server_ip,
-                'route': route_line,
-            }
-
-        urls = (
-            'https://api.ipify.org',
-            'https://icanhazip.com',
-            'https://ifconfig.me/ip',
-            'http://api.ipify.org',
-            'http://icanhazip.com',
-        )
-        binds = [server_ip, 'cascade']
-        last_detail = 'empty response'
-        for bind in binds:
-            for url in urls:
-                inner = (
-                    f'curl --interface {shlex.quote(bind)} -4 -sS --max-time 12 '
-                    f'{shlex.quote(url)} 2>&1 || true'
-                )
-                egress_out, _, _ = self.ssh.run_sudo_command(
-                    f"docker exec {shlex.quote(container)} sh -c {shlex.quote(inner)}",
-                    timeout=25,
-                )
-                egress_ip = self._parse_public_ipv4(egress_out or '')
-                if egress_ip:
-                    return {
-                        'ok': True,
-                        'skipped': False,
-                        'egress_ip': egress_ip,
-                        'bind': bind,
-                        'url': url,
-                        'route': route_line,
-                        'detail': f'{egress_ip} via {bind}',
-                    }
-                last_detail = ((egress_out or '') or 'empty response').strip()[:300]
-
-        # Handshake + policy route OK; echo services often fail from VPS — keep cascade up.
-        return {
-            'ok': True,
-            'skipped': False,
-            'warning': True,
-            'detail': (
-                f'Policy route OK via cascade, but public-IP curl failed '
-                f'(bind {server_ip}). Last: {last_detail or "empty response"}'
-            ),
-            'bind': server_ip,
-            'route': route_line,
-            'subnet': subnet,
-        }
-
-    def _vpn_subnet(self, entry_protocol: str, container: str, override: str = '') -> str:
-        if override and re.match(r'^\d+\.\d+\.\d+\.\d+/\d+$', override.strip()):
-            return override.strip()
-        conf = self._server_conf(entry_protocol)
-        out, _, _ = self.ssh.run_sudo_command(
-            f"docker exec {shlex.quote(container)} bash -lc "
-            f"\"grep -E '^Address' {shlex.quote(conf)} | head -1 | cut -d= -f2 | tr -d ' '\""
-        )
-        addr = (out or '').strip()
-        if not addr:
-            return '10.8.1.0/24'
-        if '/' in addr:
-            ip, cidr = addr.split('/', 1)
-            parts = ip.split('.')
-            if len(parts) == 4 and cidr.isdigit() and int(cidr) >= 24:
-                return f"{parts[0]}.{parts[1]}.{parts[2]}.0/{cidr}"
-            return addr
-        parts = addr.split('.')
-        if len(parts) == 4:
-            return f"{parts[0]}.{parts[1]}.{parts[2]}.0/24"
-        return '10.8.1.0/24'
-
-    def ensure_exit_return_route(self, protocol: str, peer_ip: str) -> dict:
-        """Add /32 return route for the cascade peer on the exit container (ryderams vps2)."""
-        peer_ip = (peer_ip or '').strip().split('/', 1)[0]
-        if not re.match(r'^\d+\.\d+\.\d+\.\d+$', peer_ip):
-            return {'status': 'error', 'message': 'Invalid cascade peer IP'}
-        container = self._container_name(protocol)
-        if not container:
-            return {'status': 'error', 'message': 'Unsupported exit protocol'}
-        iface = self._server_iface(protocol)
-        route_cmd = f'ip route replace {peer_ip}/32 dev {iface}'
-        script = f"""#!/bin/bash
-set -e
-START=/opt/amnezia/start.sh
-{route_cmd} 2>/dev/null || true
-[ -f "$START" ] || {{ echo CASCADE_EXIT_ROUTE_OK; exit 0; }}
-if grep -q '{EXIT_ROUTE_BEGIN}' "$START" 2>/dev/null; then
-  tmp=$(mktemp)
-  awk -v b='{EXIT_ROUTE_BEGIN}' -v e='{EXIT_ROUTE_END}' '
-    $0==b {{skip=1; next}}
-    $0==e {{skip=0; next}}
-    !skip {{print}}
-  ' "$START" > "$tmp" && mv "$tmp" "$START"
-fi
-printf '\\n%s\\n%s\\n%s\\n' '{EXIT_ROUTE_BEGIN}' '{route_cmd} || true' '{EXIT_ROUTE_END}' >> "$START"
-echo CASCADE_EXIT_ROUTE_OK
-"""
-        self.ssh.upload_file(script, '/tmp/_amnz_cascade_exit_route.sh')
-        out, err, code = self.ssh.run_sudo_command(
-            f"docker cp /tmp/_amnz_cascade_exit_route.sh {shlex.quote(container)}:/tmp/_exit_route.sh && "
-            f"docker exec {shlex.quote(container)} bash /tmp/_exit_route.sh && "
-            f"docker exec {shlex.quote(container)} rm -f /tmp/_exit_route.sh",
-            timeout=60,
-        )
-        self.ssh.run_command('rm -f /tmp/_amnz_cascade_exit_route.sh')
-        if code != 0 or 'CASCADE_EXIT_ROUTE_OK' not in (out or ''):
-            return {
-                'status': 'error',
-                'message': ((err or out) or 'Failed to set exit return route').strip()[:400],
-            }
-        return {'status': 'success', 'peer_ip': peer_ip, 'iface': iface}
-
-    def apply(
-        self,
-        entry_protocol: str,
-        exit_client_config: str,
-        exit_host: str,
-        settings: Optional[dict] = None,
-    ) -> dict:
-        opts = normalize_settings(settings)
-        container = self._container_name(entry_protocol)
-        if not container:
-            return {'status': 'error', 'message': 'Unsupported entry protocol'}
-
-        exists, _, code = self.ssh.run_sudo_command(
-            f"docker inspect -f '{{{{.State.Running}}}}' {shlex.quote(container)} 2>/dev/null"
-        )
-        if code != 0 or exists.strip().lower() != 'true':
-            return {'status': 'error', 'message': f'Entry container {container} is not running'}
-
-        cascade_conf_path = self._cascade_conf(entry_protocol)
-        cascade_up_path = self._cascade_up(entry_protocol)
-        cascade_conf = self.prepare_exit_client_config(
-            exit_client_config,
-            exit_host,
-            keep_dns=bool(opts['keep_exit_dns']),
-            allowed_ips=str(opts['allowed_ips']),
-        )
-        endpoint_host = self._extract_endpoint_host(cascade_conf) or exit_host
-        cascade_addr_cidr = self._extract_address_cidr(cascade_conf)
-        cascade_peer_ip = self._extract_address_ip(cascade_conf)
-        subnet = self._vpn_subnet(entry_protocol, container, opts.get('vpn_subnet_override') or '')
-
-        if cascade_peer_ip and self._subnet_contains_ip(subnet, cascade_peer_ip):
-            return {
-                'status': 'error',
-                'message': (
-                    f'Cascade tunnel Address {cascade_addr_cidr or cascade_peer_ip} is inside '
-                    f'entry client subnet {subnet}. Use a different VPN subnet on the exit server '
-                    f'(e.g. 10.99.0.0/24) as in ryderams/amneziawg-cascade.'
-                ),
-            }
-
-        wg_bin = self._wg_binary(entry_protocol)
-        quick_bin = self._quick_binary(entry_protocol)
-        conf_dir = self._conf_dir(entry_protocol)
-        table_id = int(opts['table_id'])
-        prio = int(opts['rule_priority'])
-        hs_timeout = int(opts['handshake_timeout_sec'])
-
-        pin_block = ''
-        if opts['pin_exit_route']:
-            pin_block = f"""
-EXIT_IP="$EXIT_HOST"
-if ! printf '%s' "$EXIT_IP" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$'; then
-  EXIT_IP=$(getent ahostsv4 "$EXIT_HOST" 2>/dev/null | awk '{{print $1; exit}}')
-  if [ -z "$EXIT_IP" ]; then
-    EXIT_IP=$(python3 - <<'PY' 2>/dev/null || true
-import socket
-print(socket.gethostbyname("{endpoint_host}"))
-PY
-)
-  fi
-fi
-GW=$(ip route | awk '/default/ {{print $3; exit}}')
-DEV=$(ip route | awk '/default/ {{print $5; exit}}')
-if [ -n "$EXIT_IP" ] && [ -n "$GW" ] && [ -n "$DEV" ]; then
-  ip route replace "$EXIT_IP/32" via "$GW" dev "$DEV" 2>/dev/null || true
-fi
-"""
-
-        remove_masq = ''
-        if opts['remove_eth_masquerade']:
-            remove_masq = f"""
-for ETH in eth0 eth1 eth2 ens3 ens5 enp0s3 enp1s0; do
-  while iptables -t nat -D POSTROUTING -s "$SUBNET" -o "$ETH" -j MASQUERADE 2>/dev/null; do :; done
-done
-"""
-
-        forward_block = ''
-        if opts['force_forward']:
-            forward_block = f"""
-sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
-for SRC_IF in awg0 wg0; do
-  iptables -C FORWARD -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null \\
-    || iptables -I FORWARD 1 -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null || true
-  iptables -C FORWARD -i "$IFACE" -o "$SRC_IF" -j ACCEPT 2>/dev/null \\
-    || iptables -I FORWARD 1 -i "$IFACE" -o "$SRC_IF" -j ACCEPT 2>/dev/null || true
-done
-iptables -C FORWARD -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \\
-  || iptables -I FORWARD 1 -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
-"""
-
-        mss_block = ''
-        if opts['mss_clamp']:
-            mss_block = """
-iptables -t mangle -C FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null \\
-  || iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-"""
-
-        handshake_block = ''
-        if opts['wait_handshake']:
-            handshake_block = f"""
-OK=0
-for i in $(seq 1 {hs_timeout}); do
-  HS=$({shlex.quote(wg_bin)} show "$IFACE" latest-handshakes 2>/dev/null | awk '{{print $2}}' | head -1)
-  if [ -n "$HS" ] && [ "$HS" != "0" ]; then OK=1; break; fi
-  sleep 1
-done
-if [ "$OK" != "1" ]; then
-  echo "CASCADE_NO_HANDSHAKE" >&2
-  echo "Tunnel interface is up but exit peer did not handshake. Check exit server / UDP port / keys." >&2
-  exit 42
-fi
-"""
-
-        up_script = f"""#!/bin/bash
-{CASCADE_MARKER}
-set -e
-CONF={shlex.quote(cascade_conf_path)}
-QUICK={shlex.quote(quick_bin)}
-SUBNET={shlex.quote(subnet)}
-EXIT_HOST={shlex.quote(endpoint_host)}
-IFACE=cascade
-TABLE={table_id}
-PRIO={prio}
-
-"$QUICK" down "$CONF" 2>/dev/null || true
-ip link delete "$IFACE" 2>/dev/null || true
-ip rule del from "$SUBNET" table "$TABLE" 2>/dev/null || true
-ip route flush table "$TABLE" 2>/dev/null || true
-
-{pin_block}
-
-"$QUICK" up "$CONF"
-
-ip route replace default dev "$IFACE" table "$TABLE" 2>/dev/null || ip route add default dev "$IFACE" table "$TABLE"
-ip rule del from "$SUBNET" table "$TABLE" 2>/dev/null || true
-ip rule add from "$SUBNET" table "$TABLE" priority "$PRIO"
-
-{remove_masq}
-{forward_block}
-iptables -t nat -C POSTROUTING -s "$SUBNET" -o "$IFACE" -j MASQUERADE 2>/dev/null \\
-  || iptables -t nat -A POSTROUTING -s "$SUBNET" -o "$IFACE" -j MASQUERADE
-{mss_block}
-{handshake_block}
-
-echo CASCADE_UP_OK
-"""
-
-        self.ssh.run_sudo_command(f"docker exec {shlex.quote(container)} mkdir -p {shlex.quote(conf_dir)}")
-        self.ssh.upload_file(cascade_conf, '/tmp/_amnz_cascade.conf')
-        self.ssh.upload_file(up_script, '/tmp/_amnz_cascade_up.sh')
-        self.ssh.run_sudo_command(
-            f"docker cp /tmp/_amnz_cascade.conf {shlex.quote(container)}:{shlex.quote(cascade_conf_path)} && "
-            f"docker cp /tmp/_amnz_cascade_up.sh {shlex.quote(container)}:{shlex.quote(cascade_up_path)} && "
-            f"docker exec {shlex.quote(container)} chmod 644 {shlex.quote(cascade_conf_path)} && "
-            f"docker exec {shlex.quote(container)} chmod +x {shlex.quote(cascade_up_path)}"
-        )
-        self.ssh.run_command('rm -f /tmp/_amnz_cascade.conf /tmp/_amnz_cascade_up.sh')
-
-        self._ensure_start_hook(container, cascade_up_path)
-
-        out, err, code = self.ssh.run_sudo_command(
-            f"docker exec {shlex.quote(container)} bash {shlex.quote(cascade_up_path)}",
-            timeout=max(90, hs_timeout + 40),
-        )
-        combined = ((out or '') + '\n' + (err or '')).strip()
-        if code != 0 or 'CASCADE_UP_OK' not in (out or ''):
-            msg = combined
-            if 'CASCADE_NO_HANDSHAKE' in combined:
-                msg = (
-                    'Туннель к серверу выхода поднят, но handshake не прошёл. '
-                    'Проверьте, что на выходе открыт UDP-порт, протокол совпадает, '
-                    'и входной сервер может достучаться до IP выхода.'
-                )
-            return {
-                'status': 'error',
-                'message': (msg or 'Failed to bring cascade interface up').strip()[:900],
-                'log': combined[:2000],
-            }
-
-        st = self.status(entry_protocol)
-        handshake_ok = bool(st.get('handshake'))
-
-        egress_info = {}
-        if opts.get('verify_egress', True) and handshake_ok:
-            egress_info = self._verify_egress(container, entry_protocol, subnet)
-            if not egress_info.get('ok'):
-                try:
-                    self.disable(entry_protocol, settings=opts)
-                except Exception:
-                    pass
-                bind = egress_info.get('bind') or 'awg0'
-                detail = egress_info.get('detail') or 'empty response'
-                route = egress_info.get('route') or ''
-                return {
-                    'status': 'error',
-                    'message': (
-                        'Cascade handshake OK but egress verify failed '
-                        f'(curl --interface {bind} via client subnet {subnet}). '
-                        f'Detail: {detail}'
-                        + (f' Route: {route}' if route else '')
-                    ),
-                    'handshake': True,
-                    'up': bool(st.get('up')),
-                    'egress': egress_info,
-                    'log': combined[:1500],
-                }
-
-        return {
-            'status': 'success',
-            'subnet': subnet,
-            'endpoint': endpoint_host,
-            'container': container,
-            'cascade_peer_ip': cascade_peer_ip,
-            'cascade_address': cascade_addr_cidr,
-            'up': bool(st.get('up')),
-            'handshake': handshake_ok,
-            'egress': egress_info or None,
-            'warning': (egress_info or {}).get('detail') if (egress_info or {}).get('warning') else None,
-            'settings': opts,
-            'applied_at': datetime.now().isoformat(timespec='seconds'),
-            'diagnostics': st.get('raw', '')[:1500],
-        }
-
-    def _ensure_start_hook(self, container: str, cascade_up_path: str) -> None:
-        marker = CASCADE_MARKER
-        installer = f"""#!/bin/bash
-set -e
-START=/opt/amnezia/start.sh
-[ -f "$START" ] || exit 0
-grep -q '{marker}' "$START" 2>/dev/null && exit 0
-printf '\\n%s\\n' '{marker}' >> "$START"
-printf '%s\\n' 'if [ -x {cascade_up_path} ]; then bash {cascade_up_path} || true; fi' >> "$START"
-"""
-        self.ssh.upload_file(installer, '/tmp/_amnz_cascade_hook.sh')
-        self.ssh.run_sudo_command(
-            f"docker cp /tmp/_amnz_cascade_hook.sh {shlex.quote(container)}:/tmp/_hook.sh && "
-            f"docker exec {shlex.quote(container)} bash /tmp/_hook.sh && "
-            f"docker exec {shlex.quote(container)} rm -f /tmp/_hook.sh"
-        )
-        self.ssh.run_command('rm -f /tmp/_amnz_cascade_hook.sh')
-
-    def disable(self, entry_protocol: str, settings: Optional[dict] = None) -> dict:
-        opts = normalize_settings(settings)
-        container = self._container_name(entry_protocol)
-        if not container:
-            return {'status': 'error', 'message': 'Unsupported entry protocol'}
-        conf = self._cascade_conf(entry_protocol)
-        up = self._cascade_up(entry_protocol)
-        quick_bin = self._quick_binary(entry_protocol)
-        table_id = int(opts['table_id'])
-        script = f"""#!/bin/bash
-set +e
-QUICK={shlex.quote(quick_bin)}
-CONF={shlex.quote(conf)}
-UP={shlex.quote(up)}
-TABLE={table_id}
-"$QUICK" down "$CONF" 2>/dev/null
-ip link delete cascade 2>/dev/null
-ip rule del table "$TABLE" 2>/dev/null
-ip rule del table "$TABLE" 2>/dev/null
-ip route flush table "$TABLE" 2>/dev/null
-rm -f "$CONF" "$UP"
-echo CASCADE_DOWN_OK
-"""
-        self.ssh.upload_file(script, '/tmp/_amnz_cascade_down.sh')
-        out, err, code = self.ssh.run_sudo_command(
-            f"docker cp /tmp/_amnz_cascade_down.sh {shlex.quote(container)}:/tmp/_cascade_down.sh && "
-            f"docker exec {shlex.quote(container)} bash /tmp/_cascade_down.sh && "
-            f"docker exec {shlex.quote(container)} rm -f /tmp/_cascade_down.sh",
-            timeout=60,
-        )
-        self.ssh.run_command('rm -f /tmp/_amnz_cascade_down.sh')
-        if code != 0 and 'CASCADE_DOWN_OK' not in (out or ''):
-            return {'status': 'success', 'message': (err or out or 'Cascade cleared (best effort)').strip()[:400]}
-        return {'status': 'success'}

managers/update_manager.py

@@ -0,0 +1,394 @@
+"""Panel self-update from the EvilFox Gitea repository (git or release archive)."""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import urllib.error
+import urllib.request
+import zipfile
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_REPO_URL = 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main'
+DEFAULT_GIT_URL = 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main.git'
+DEFAULT_API_LATEST = 'https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest'
+UPDATE_REMOTE = 'panel-update'
+
+ARCHIVE_SKIP_DIRS = frozenset({
+    '__pycache__', '.git', 'bin', 'data', 'node_modules', '.venv', 'venv', '.cursor',
+})
+ARCHIVE_SKIP_FILES = frozenset({
+    '.env', 'data.json', 'tunnels_state.json',
+})
+
+
+def _env(name: str, default: str) -> str:
+    return (os.environ.get(name) or default).strip()
+
+
+def repo_url() -> str:
+    return _env('PANEL_UPDATE_REPO_URL', DEFAULT_REPO_URL).rstrip('/')
+
+
+def git_url() -> str:
+    return _env('PANEL_UPDATE_GIT_URL', DEFAULT_GIT_URL)
+
+
+def api_latest_url() -> str:
+    return _env('PANEL_UPDATE_API_LATEST', DEFAULT_API_LATEST)
+
+
+def parse_version(value: str) -> tuple:
+    """Parse semver-ish tags like v2.3.0 / 2.3.0-beta into a comparable tuple."""
+    raw = (value or '').strip()
+    if not raw:
+        return (0, 0, 0, 1, '')
+    raw = raw.lstrip('vV')
+    main, _, pre = raw.partition('-')
+    parts = []
+    for piece in main.split('.'):
+        if piece.isdigit():
+            parts.append(int(piece))
+        else:
+            m = re.match(r'(\d+)', piece or '')
+            parts.append(int(m.group(1)) if m else 0)
+    while len(parts) < 3:
+        parts.append(0)
+    pre_rank = 0 if not pre else 1
+    return (parts[0], parts[1], parts[2], pre_rank, pre)
+
+
+def version_gt(a: str, b: str) -> bool:
+    return parse_version(a) > parse_version(b)
+
+
+def normalize_tag(value: str) -> str:
+    tag = (value or '').strip()
+    if not tag:
+        return ''
+    return tag if tag.startswith('v') else f'v{tag}'
+
+
+def _run(cmd: list, cwd: str, timeout: int = 120) -> tuple[int, str, str]:
+    try:
+        proc = subprocess.run(
+            cmd,
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            encoding='utf-8',
+            errors='replace',
+        )
+        return proc.returncode, (proc.stdout or '').strip(), (proc.stderr or '').strip()
+    except FileNotFoundError:
+        return 127, '', f'Command not found: {cmd[0]}'
+    except subprocess.TimeoutExpired:
+        return 124, '', f'Timeout running: {" ".join(cmd)}'
+
+
+class UpdateManager:
+    def __init__(self, app_root: str, current_version: str):
+        self.app_root = os.path.abspath(app_root)
+        self.current_version = current_version
+
+    def _in_docker(self) -> bool:
+        return os.path.exists('/.dockerenv') or os.environ.get('PANEL_IN_DOCKER') == '1'
+
+    def _docker_update_allowed(self) -> bool:
+        return os.environ.get('PANEL_UPDATE_ALLOW_DOCKER', '').strip().lower() in ('1', 'true', 'yes')
+
+    def _app_root_writable(self) -> bool:
+        probe = os.path.join(self.app_root, '.panel_update_write_probe')
+        try:
+            with open(probe, 'w', encoding='utf-8') as fh:
+                fh.write('ok')
+            os.remove(probe)
+            return True
+        except OSError:
+            return False
+
+    def detect_mode(self) -> dict:
+        frozen = bool(getattr(sys, 'frozen', False))
+        in_docker = self._in_docker()
+        git_dir = os.path.join(self.app_root, '.git')
+        is_git = os.path.isdir(git_dir)
+        git_ok = False
+        if is_git and not frozen:
+            code, _, _ = _run(['git', '--version'], self.app_root, timeout=10)
+            git_ok = code == 0
+
+        writable = self._app_root_writable()
+        can_git = bool(git_ok and is_git and not frozen)
+        can_archive = bool(
+            writable
+            and not frozen
+            and (not in_docker or self._docker_update_allowed())
+        )
+        can_auto = can_git or can_archive
+
+        if can_git:
+            method = 'git'
+        elif can_archive:
+            method = 'archive'
+        elif in_docker:
+            method = 'docker'
+        elif frozen:
+            method = 'binary'
+        else:
+            method = 'manual'
+
+        return {
+            'mode': method,
+            'update_method': method,
+            'can_auto_update': can_auto,
+            'can_git_update': can_git,
+            'can_archive_update': can_archive,
+            'is_git': is_git,
+            'frozen': frozen,
+            'in_docker': in_docker,
+            'writable': writable,
+            'app_root': self.app_root,
+            'repo_url': repo_url(),
+            'git_url': git_url(),
+        }
+
+    def _ensure_update_remote(self) -> Optional[str]:
+        code, out, err = _run(['git', 'remote'], self.app_root, timeout=15)
+        if code != 0:
+            return err or out or 'git remote failed'
+        remotes = set((out or '').split())
+        target = git_url()
+        if UPDATE_REMOTE in remotes:
+            code, _, err = _run(
+                ['git', 'remote', 'set-url', UPDATE_REMOTE, target],
+                self.app_root,
+                timeout=15,
+            )
+        else:
+            code, _, err = _run(
+                ['git', 'remote', 'add', UPDATE_REMOTE, target],
+                self.app_root,
+                timeout=15,
+            )
+        if code != 0:
+            return err or 'Failed to configure update remote'
+        return None
+
+    def working_tree_dirty(self) -> bool:
+        code, out, _ = _run(['git', 'status', '--porcelain'], self.app_root, timeout=30)
+        return code == 0 and bool(out.strip())
+
+    def _pip_install(self) -> tuple[bool, str]:
+        req = os.path.join(self.app_root, 'requirements.txt')
+        if not os.path.isfile(req):
+            return True, ''
+        code_p, out_p, err_p = _run(
+            [sys.executable, '-m', 'pip', 'install', '-r', req],
+            self.app_root,
+            timeout=300,
+        )
+        log = (out_p or err_p or '')[:1500]
+        return code_p == 0, log
+
+    def _apply_git_update(self, target: str, allow_dirty: bool) -> dict:
+        if not allow_dirty and self.working_tree_dirty():
+            return {
+                'status': 'error',
+                'message': (
+                    'Working tree has local changes. Confirm update anyway to force checkout, '
+                    'or commit/stash changes first.'
+                ),
+                'needs_confirm_dirty': True,
+            }
+
+        err = self._ensure_update_remote()
+        if err:
+            return {'status': 'error', 'message': err}
+
+        code, out, stderr = _run(
+            ['git', 'fetch', '--tags', '--force', UPDATE_REMOTE],
+            self.app_root,
+            timeout=180,
+        )
+        if code != 0:
+            return {'status': 'error', 'message': f'git fetch failed: {stderr or out or code}'}
+
+        # Ensure tag is present locally
+        code, _, _ = _run(
+            ['git', 'rev-parse', '-q', '--verify', f'refs/tags/{target}'],
+            self.app_root,
+            timeout=15,
+        )
+        if code != 0:
+            _run(
+                ['git', 'fetch', '--depth', '1', UPDATE_REMOTE, f'refs/tags/{target}:refs/tags/{target}'],
+                self.app_root,
+                timeout=120,
+            )
+
+        checkout_ref = f'tags/{target}'
+        code, out, stderr = _run(
+            ['git', 'checkout', '--force', checkout_ref],
+            self.app_root,
+            timeout=60,
+        )
+        if code != 0:
+            code_m, out_m, err_m = _run(
+                ['git', 'checkout', '--force', '-B', 'main', f'{UPDATE_REMOTE}/main'],
+                self.app_root,
+                timeout=60,
+            )
+            if code_m != 0:
+                return {
+                    'status': 'error',
+                    'message': f'git checkout {target} failed: {stderr or out or err_m or out_m}',
+                }
+            checkout_ref = f'{UPDATE_REMOTE}/main'
+
+        ok, pip_log = self._pip_install()
+        if not ok:
+            return {
+                'status': 'error',
+                'message': f'pip install failed after checkout: {pip_log[:500]}',
+                'checkout': checkout_ref,
+                'method': 'git',
+            }
+
+        return {
+            'status': 'success',
+            'message': f'Updated to {target} via git. Panel will restart.',
+            'target_version': target,
+            'checkout': checkout_ref,
+            'pip': pip_log[:500],
+            'method': 'git',
+            'restart': True,
+        }
+
+    def _archive_urls(self, tag: str) -> list[str]:
+        base = repo_url()
+        return [
+            f'{base}/archive/{tag}.zip',
+            f'{base}/archive/{tag.lstrip("v")}.zip',
+            f'{api_latest_url().rsplit("/releases/latest", 1)[0]}/archive/{tag}.zip',
+        ]
+
+    def _download_archive(self, tag: str, dest_path: str) -> None:
+        last_err = 'unknown error'
+        for url in self._archive_urls(tag):
+            try:
+                req = urllib.request.Request(url, headers={'User-Agent': 'Amnezia-Web-Panel-Updater'})
+                with urllib.request.urlopen(req, timeout=180) as resp:
+                    with open(dest_path, 'wb') as out:
+                        shutil.copyfileobj(resp, out)
+                if os.path.getsize(dest_path) > 1024:
+                    return
+                last_err = f'empty archive from {url}'
+            except urllib.error.HTTPError as e:
+                last_err = f'HTTP {e.code} for {url}'
+            except Exception as e:
+                last_err = str(e)
+        raise RuntimeError(f'Failed to download release archive: {last_err}')
+
+    @staticmethod
+    def _extract_zip_root(extract_dir: str) -> str:
+        entries = [e for e in os.listdir(extract_dir) if e not in ('.', '..')]
+        if len(entries) == 1:
+            only = os.path.join(extract_dir, entries[0])
+            if os.path.isdir(only):
+                return only
+        return extract_dir
+
+    def _sync_tree(self, src_root: str) -> None:
+        for root, dirs, files in os.walk(src_root):
+            dirs[:] = [d for d in dirs if d not in ARCHIVE_SKIP_DIRS]
+            rel = os.path.relpath(root, src_root)
+            dest_root = self.app_root if rel in ('.', '') else os.path.join(self.app_root, rel)
+            os.makedirs(dest_root, exist_ok=True)
+            for fname in files:
+                if fname in ARCHIVE_SKIP_FILES:
+                    continue
+                src_file = os.path.join(root, fname)
+                dest_file = os.path.join(dest_root, fname)
+                shutil.copy2(src_file, dest_file)
+
+    def _apply_archive_update(self, target: str) -> dict:
+        tmpdir = tempfile.mkdtemp(prefix='panel-update-')
+        zip_path = os.path.join(tmpdir, f'{target}.zip')
+        extract_dir = os.path.join(tmpdir, 'extract')
+        try:
+            self._download_archive(target, zip_path)
+            os.makedirs(extract_dir, exist_ok=True)
+            with zipfile.ZipFile(zip_path, 'r') as zf:
+                zf.extractall(extract_dir)
+            src_root = self._extract_zip_root(extract_dir)
+            if not os.path.isdir(src_root):
+                return {'status': 'error', 'message': 'Invalid release archive layout'}
+            self._sync_tree(src_root)
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'method': 'archive'}
+        finally:
+            shutil.rmtree(tmpdir, ignore_errors=True)
+
+        ok, pip_log = self._pip_install()
+        if not ok:
+            return {
+                'status': 'error',
+                'message': f'Files updated but pip install failed: {pip_log[:500]}',
+                'method': 'archive',
+            }
+
+        return {
+            'status': 'success',
+            'message': f'Updated to {target} from release archive. Panel will restart.',
+            'target_version': target,
+            'pip': pip_log[:500],
+            'method': 'archive',
+            'restart': True,
+        }
+
+    def apply_update(self, target_version: str, allow_dirty: bool = False) -> dict:
+        mode = self.detect_mode()
+        target = normalize_tag(target_version)
+        if not target or not re.match(r'^v\d+(\.\d+){0,3}([.-][\w.]+)?$', target):
+            return {'status': 'error', 'message': f'Invalid target version: {target_version}'}
+
+        if mode.get('can_git_update'):
+            return self._apply_git_update(target, allow_dirty)
+        if mode.get('can_archive_update'):
+            return self._apply_archive_update(target)
+
+        hint = (
+            'Cannot update from inside this install. '
+            'Use a git clone or writable source directory, or rebuild the Docker image on the host.'
+        )
+        if mode.get('in_docker'):
+            hint = (
+                'Docker image install: on the host run '
+                '`git pull && docker compose up -d --build` '
+                '(or set PANEL_UPDATE_ALLOW_DOCKER=1 if /app is bind-mounted).'
+            )
+        return {'status': 'error', 'message': hint, 'mode': mode}
+
+    @staticmethod
+    def schedule_restart(delay_sec: float = 1.5) -> None:
+        def _restart():
+            time.sleep(max(0.5, float(delay_sec)))
+            try:
+                argv = [sys.executable] + sys.argv
+                logger.info('Restarting panel after update: %s', argv)
+                os.execv(sys.executable, argv)
+            except Exception:
+                logger.exception('Failed to restart after update; exiting')
+                os._exit(0)
+
+        threading.Thread(target=_restart, name='panel-update-restart', daemon=False).start()

templates/server.html

@@ -157,153 +157,6 @@
     </div>
 </div>
 
-<!-- Cascade (double VPN) -->
-<section class="card" id="cascadeSection" style="margin-bottom: var(--space-xl);">
-    <div class="card-header" style="align-items:flex-start; flex-wrap:wrap; gap:var(--space-sm);">
-        <div>
-            <h2 class="card-title" style="margin:0;">{{ _('cascade_title') }}</h2>
-            <p class="form-hint" style="margin:var(--space-xs) 0 0;">{{ _('cascade_desc') }}</p>
-        </div>
-        <span class="badge badge-warn" id="cascadeStatusBadge">{{ _('cascade_off') }}</span>
-    </div>
-    <div style="padding: 0 var(--space-md) var(--space-md);">
-        <div class="grid" style="display:grid; grid-template-columns:1fr 1fr; gap:var(--space-md);">
-            <div class="form-group">
-                <label class="form-label">{{ _('cascade_entry_protocol') }}</label>
-                <select class="form-select" id="cascadeEntryProtocol">
-                    <option value="awg2" selected>AmneziaWG 2.0</option>
-                    <option value="awg">AmneziaWG</option>
-                    <option value="awg_legacy">AWG Legacy</option>
-                    <option value="wireguard">WireGuard</option>
-                </select>
-            </div>
-            <div class="form-group">
-                <label class="form-label">{{ _('cascade_exit_server') }}</label>
-                <select class="form-select" id="cascadeExitServer" onchange="fillCascadeExitProtocols()">
-                    <option value="">{{ _('cascade_exit_server_none') }}</option>
-                    {% for s in all_servers %}
-                    {% if loop.index0 != server_id %}
-                    <option value="{{ loop.index0 }}"
-                        data-protocols="{% for k in (s.protocols or {}).keys() %}{{ k }}{% if not loop.last %},{% endif %}{% endfor %}">
-                        {{ s.name or s.host }} ({{ s.host }})
-                    </option>
-                    {% endif %}
-                    {% endfor %}
-                </select>
-            </div>
-            <div class="form-group">
-                <label class="form-label">{{ _('cascade_exit_protocol') }}</label>
-                <select class="form-select" id="cascadeExitProtocol">
-                    <option value="awg2" selected>AmneziaWG 2.0</option>
-                    <option value="awg">AmneziaWG</option>
-                    <option value="awg_legacy">AWG Legacy</option>
-                    <option value="wireguard">WireGuard</option>
-                </select>
-            </div>
-        </div>
-        <div class="form-hint" style="margin-bottom:var(--space-sm);">{{ _('cascade_hint') }}</div>
-        <div class="form-hint" style="margin-bottom:var(--space-sm);">{{ _('cascade_client_note') }}</div>
-        <div class="form-hint" style="margin-bottom:var(--space-md);">{{ _('cascade_security_note') }}</div>
-
-        <details id="cascadeSettingsPanel" open style="margin-bottom:var(--space-md); border:1px solid var(--border); border-radius:var(--radius-md); padding:var(--space-sm) var(--space-md);">
-            <summary style="cursor:pointer; font-weight:600; margin-bottom:var(--space-sm);">{{ _('cascade_settings_title') }}</summary>
-            <p class="form-hint" style="margin:0 0 var(--space-md);">{{ _('cascade_settings_desc') }}</p>
-            <div class="grid" style="display:grid; grid-template-columns:1fr 1fr; gap:var(--space-sm) var(--space-md);">
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadePinExitRoute" checked>
-                    <span>
-                        <strong>{{ _('cascade_opt_pin_exit') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_opt_pin_exit_hint') }}</span>
-                    </span>
-                </label>
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadeRemoveEthMasq" checked>
-                    <span>
-                        <strong>{{ _('cascade_opt_remove_eth_masq') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_opt_remove_eth_masq_hint') }}</span>
-                    </span>
-                </label>
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadeForceForward" checked>
-                    <span>
-                        <strong>{{ _('cascade_opt_force_forward') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_opt_force_forward_hint') }}</span>
-                    </span>
-                </label>
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadeMssClamp" checked>
-                    <span>
-                        <strong>{{ _('cascade_opt_mss_clamp') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_opt_mss_clamp_hint') }}</span>
-                    </span>
-                </label>
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadeWaitHandshake" checked>
-                    <span>
-                        <strong>{{ _('cascade_opt_wait_handshake') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_opt_wait_handshake_hint') }}</span>
-                    </span>
-                </label>
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadeVerifyEgress" checked>
-                    <span>
-                        <strong>{{ _('cascade_verify_egress') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_verify_egress_hint') }}</span>
-                    </span>
-                </label>
-                <label class="form-check" style="display:flex; gap:var(--space-sm); align-items:flex-start;">
-                    <input type="checkbox" id="cascadeKeepExitDns">
-                    <span>
-                        <strong>{{ _('cascade_opt_keep_dns') }}</strong>
-                        <span class="form-hint" style="display:block;">{{ _('cascade_opt_keep_dns_hint') }}</span>
-                    </span>
-                </label>
-            </div>
-            <div class="grid" style="display:grid; grid-template-columns:1fr 1fr 1fr; gap:var(--space-md); margin-top:var(--space-md);">
-                <div class="form-group" style="margin:0;">
-                    <label class="form-label" for="cascadeHandshakeTimeout">{{ _('cascade_opt_handshake_timeout') }}</label>
-                    <input type="number" class="form-input" id="cascadeHandshakeTimeout" min="5" max="120" value="25">
-                </div>
-                <div class="form-group" style="margin:0;">
-                    <label class="form-label" for="cascadeTableId">{{ _('cascade_opt_table_id') }}</label>
-                    <input type="number" class="form-input" id="cascadeTableId" min="1" max="252" value="200">
-                </div>
-                <div class="form-group" style="margin:0;">
-                    <label class="form-label" for="cascadeRulePriority">{{ _('cascade_opt_rule_priority') }}</label>
-                    <input type="number" class="form-input" id="cascadeRulePriority" min="1" max="32765" value="100">
-                </div>
-            </div>
-            <div class="grid" style="display:grid; grid-template-columns:1fr 1fr; gap:var(--space-md); margin-top:var(--space-md);">
-                <div class="form-group" style="margin:0;">
-                    <label class="form-label" for="cascadeAllowedIps">{{ _('cascade_opt_allowed_ips') }}</label>
-                    <input type="text" class="form-input" id="cascadeAllowedIps" value="0.0.0.0/0">
-                    <span class="form-hint">{{ _('cascade_opt_allowed_ips_hint') }}</span>
-                </div>
-                <div class="form-group" style="margin:0;">
-                    <label class="form-label" for="cascadeVpnSubnet">{{ _('cascade_opt_vpn_subnet') }}</label>
-                    <input type="text" class="form-input" id="cascadeVpnSubnet" placeholder="10.8.1.0/24" value="">
-                    <span class="form-hint">{{ _('cascade_opt_vpn_subnet_hint') }}</span>
-                </div>
-            </div>
-        </details>
-
-        <div id="cascadeDiagBox" class="hidden" style="margin-bottom:var(--space-md); padding:var(--space-sm) var(--space-md); background:var(--bg-muted, rgba(0,0,0,.04)); border-radius:var(--radius-md); font-family:ui-monospace,monospace; font-size:12px; white-space:pre-wrap; max-height:160px; overflow:auto;"></div>
-
-        <div class="flex gap-sm" style="flex-wrap:wrap;">
-            <button type="button" class="btn btn-primary" id="cascadeEnableBtn" onclick="enableCascade()">
-                {{ _('cascade_enable') }}
-            </button>
-            <button type="button" class="btn btn-secondary" id="cascadeDisableBtn" onclick="disableCascade()">
-                {{ _('cascade_disable') }}
-            </button>
-            <button type="button" class="btn btn-secondary" onclick="loadCascade()">{{ _('refresh') }}</button>
-        </div>
-        <div id="cascadeBusy" class="hidden" style="display:none; align-items:center; gap:var(--space-sm); margin-top:var(--space-md);">
-            <div class="spinner" style="width:18px;height:18px;border-width:2px;"></div>
-            <span id="cascadeBusyText">{{ _('cascade_working') }}</span>
-        </div>
-    </div>
-</section>
 <!-- Installed Applications Section -->
 
 <div class="apps-loading" id="installedAppsLoading">
@@ -1576,7 +1429,6 @@
             }
             updateStatusCounts(data.protocols || {});
             showToast(_('server_check_complete'), 'success');
-            loadCascade();
         } catch (err) {
             showToast(_('error') + ': ' + err.message, 'error');
             const statusDiv = document.getElementById('serverStatus');
@@ -3114,184 +2966,8 @@
 
 
 
-    // ========== Cascade (double VPN) ==========
-    const CASCADE_PROTOS = ['awg2', 'awg', 'awg_legacy', 'wireguard'];
-
-    function fillCascadeExitProtocols() {
-        const sel = document.getElementById('cascadeExitServer');
-        const opt = sel.options[sel.selectedIndex];
-        const protoSel = document.getElementById('cascadeExitProtocol');
-        const raw = (opt && opt.dataset.protocols) ? opt.dataset.protocols.split(',').filter(Boolean) : [];
-        const available = raw.filter(p => CASCADE_PROTOS.includes(protoBase(p)));
-        const prev = protoSel.value;
-        protoSel.innerHTML = '';
-        const list = available.length ? available : CASCADE_PROTOS;
-        list.forEach(p => {
-            const o = document.createElement('option');
-            o.value = p;
-            o.textContent = getProtoTitle(p);
-            protoSel.appendChild(o);
-        });
-        if (list.includes(prev)) protoSel.value = prev;
-        else if (list.includes('awg2')) protoSel.value = 'awg2';
-    }
-
-    function setCascadeBusy(on, text) {
-        const busy = document.getElementById('cascadeBusy');
-        const busyText = document.getElementById('cascadeBusyText');
-        const en = document.getElementById('cascadeEnableBtn');
-        const dis = document.getElementById('cascadeDisableBtn');
-        if (busyText && text) busyText.textContent = text;
-        if (busy) {
-            busy.classList.toggle('hidden', !on);
-            busy.style.display = on ? 'flex' : 'none';
-        }
-        if (en) en.disabled = !!on;
-        if (dis) dis.disabled = !!on;
-    }
-
-    function cascadeBool(id, fallback) {
-        const el = document.getElementById(id);
-        return el ? !!el.checked : !!fallback;
-    }
-
-    function cascadeNum(id, fallback) {
-        const el = document.getElementById(id);
-        const n = el ? parseInt(el.value, 10) : NaN;
-        return Number.isFinite(n) ? n : fallback;
-    }
-
-    function collectCascadeSettings() {
-        return {
-            pin_exit_route: cascadeBool('cascadePinExitRoute', true),
-            remove_eth_masquerade: cascadeBool('cascadeRemoveEthMasq', true),
-            force_forward: cascadeBool('cascadeForceForward', true),
-            mss_clamp: cascadeBool('cascadeMssClamp', true),
-            wait_handshake: cascadeBool('cascadeWaitHandshake', true),
-            verify_egress: cascadeBool('cascadeVerifyEgress', true),
-            keep_exit_dns: cascadeBool('cascadeKeepExitDns', false),
-            handshake_timeout_sec: cascadeNum('cascadeHandshakeTimeout', 25),
-            table_id: cascadeNum('cascadeTableId', 200),
-            rule_priority: cascadeNum('cascadeRulePriority', 100),
-            allowed_ips: (document.getElementById('cascadeAllowedIps') || {}).value || '0.0.0.0/0',
-            vpn_subnet_override: (document.getElementById('cascadeVpnSubnet') || {}).value || '',
-        };
-    }
-
-    function applyCascadeSettingsToForm(settings, defaults) {
-        const s = Object.assign({}, defaults || {}, settings || {});
-        const setCheck = (id, val) => { const el = document.getElementById(id); if (el) el.checked = !!val; };
-        const setVal = (id, val) => { const el = document.getElementById(id); if (el && val !== undefined && val !== null) el.value = val; };
-        setCheck('cascadePinExitRoute', s.pin_exit_route !== false);
-        setCheck('cascadeRemoveEthMasq', s.remove_eth_masquerade !== false);
-        setCheck('cascadeForceForward', s.force_forward !== false);
-        setCheck('cascadeMssClamp', s.mss_clamp !== false);
-        setCheck('cascadeWaitHandshake', s.wait_handshake !== false);
-        setCheck('cascadeVerifyEgress', s.verify_egress !== false);
-        setCheck('cascadeKeepExitDns', !!s.keep_exit_dns);
-        setVal('cascadeHandshakeTimeout', s.handshake_timeout_sec ?? 25);
-        setVal('cascadeTableId', s.table_id ?? 200);
-        setVal('cascadeRulePriority', s.rule_priority ?? 100);
-        setVal('cascadeAllowedIps', s.allowed_ips || '0.0.0.0/0');
-        setVal('cascadeVpnSubnet', s.vpn_subnet_override || '');
-    }
-
-    function updateCascadeDiag(cascade, live) {
-        const box = document.getElementById('cascadeDiagBox');
-        if (!box) return;
-        const parts = [];
-        if (cascade && cascade.enabled) {
-            parts.push('handshake: ' + ((live && live.handshake) || cascade.handshake ? 'ok' : 'NONE'));
-            if (cascade.diagnostics) parts.push(String(cascade.diagnostics).trim());
-            else if (live && live.raw) parts.push(String(live.raw).trim());
-            if (cascade.last_error) parts.push('error: ' + cascade.last_error);
-        }
-        const text = parts.filter(Boolean).join('\n\n');
-        box.textContent = text;
-        box.classList.toggle('hidden', !text);
-    }
-
-    function updateCascadeBadge(cascade, live) {
-        const badge = document.getElementById('cascadeStatusBadge');
-        if (!badge) return;
-        const enabled = !!(cascade && cascade.enabled);
-        const up = !!(live && live.up);
-        const hs = !!(live && live.handshake) || !!(cascade && cascade.handshake);
-        badge.className = 'badge ' + (enabled && up && hs ? 'badge-success' : (enabled ? 'badge-warn' : 'badge-warn'));
-        if (!enabled) badge.textContent = _('cascade_off');
-        else if (up && hs) badge.textContent = _('cascade_on');
-        else if (up && !hs) badge.textContent = _('cascade_no_handshake');
-        else badge.textContent = _('cascade_configured_down');
-        updateCascadeDiag(cascade, live);
-    }
-
-    async function loadCascade() {
-        try {
-            const res = await apiCall(`/api/servers/${SERVER_ID}/cascade`, 'POST', {});
-            const c = res.cascade || {};
-            if (c.entry_protocol) document.getElementById('cascadeEntryProtocol').value = c.entry_protocol;
-            if (c.exit_server_id !== undefined && c.exit_server_id !== null && c.exit_server_id !== '') {
-                document.getElementById('cascadeExitServer').value = String(c.exit_server_id);
-                fillCascadeExitProtocols();
-            }
-            if (c.exit_protocol) {
-                const exitProto = document.getElementById('cascadeExitProtocol');
-                if ([...exitProto.options].some(o => o.value === c.exit_protocol)) {
-                    exitProto.value = c.exit_protocol;
-                }
-            }
-            applyCascadeSettingsToForm(c.settings || {}, res.defaults || {});
-            updateCascadeBadge(c, res.live || {});
-        } catch (err) {
-            console.error(err);
-        }
-    }
-
-    async function setupCascade(enable) {
-        const entryProtocol = document.getElementById('cascadeEntryProtocol').value;
-        const exitServerId = document.getElementById('cascadeExitServer').value;
-        const exitProtocol = document.getElementById('cascadeExitProtocol').value;
-        if (enable && exitServerId === '') {
-            showToast(_('cascade_exit_required'), 'error');
-            return;
-        }
-        if (enable && !confirm(_('cascade_enable_confirm'))) return;
-        if (!enable && !confirm(_('cascade_disable_confirm'))) return;
-
-        setCascadeBusy(true, enable ? _('cascade_working') : _('cascade_disabling'));
-        showToast(enable ? _('cascade_working') : _('cascade_disabling'), 'info');
-        try {
-            const settings = collectCascadeSettings();
-            const res = await apiCall(`/api/servers/${SERVER_ID}/cascade/setup`, 'POST', {
-                enabled: !!enable,
-                entry_protocol: entryProtocol,
-                exit_server_id: parseInt(exitServerId || '0', 10),
-                exit_protocol: exitProtocol,
-                ...settings,
-            });
-            updateCascadeBadge(res.cascade || {}, {
-                up: !!(res.cascade && res.cascade.up),
-                handshake: !!(res.cascade && res.cascade.handshake),
-            });
-            showToast(enable ? _('cascade_enabled') : _('cascade_disabled'), 'success');
-            if (enable && res.warning) {
-                showToast(res.warning, 'info');
-            }
-            await loadCascade();
-        } catch (err) {
-            showToast(_('error') + ': ' + err.message, 'error');
-        } finally {
-            setCascadeBusy(false);
-        }
-    }
-
-    function enableCascade() { return setupCascade(true); }
-    function disableCascade() { return setupCascade(false); }
-
     // ========== Init ==========
     applyInstalledAppsVisibility();
-    fillCascadeExitProtocols();
-    loadCascade();
     checkServer();
     loadServerStats();
 </script>

templates/settings.html

@@ -284,6 +284,30 @@
                         </button>
                     </div>
                 </div>
+
+                <div class="tunnel-row" data-provider="nordvpn" style="padding: var(--space-md); border: 1px solid var(--border-color); border-radius: var(--radius-md); background: var(--bg-primary);">
+                    <div style="display:flex; align-items:center; justify-content:space-between; gap:var(--space-md); margin-bottom: var(--space-sm);">
+                        <strong>NordVPN</strong>
+                        <span class="badge badge-secondary" id="nordvpnInstallBadge">{{ _('not_installed') }}</span>
+                    </div>
+                    <div id="nordvpnStatusText" class="form-hint" style="margin-bottom: var(--space-sm);">{{ _('nordvpn_status_unknown') }}</div>
+                    <div id="nordvpnServerText" class="form-hint hidden" style="margin-bottom: var(--space-sm);"></div>
+                    <div id="nordvpnHintText" class="form-hint" style="margin-bottom: var(--space-sm);">{{ _('nordvpn_hint') }}</div>
+                    <div class="grid" style="display:grid; grid-template-columns: 1fr 1fr; gap: var(--space-sm); margin-bottom: var(--space-sm);">
+                        <input type="text" class="form-input" id="nordvpnCountry" placeholder="{{ _('nordvpn_country_placeholder') }}" autocomplete="off">
+                        <input type="text" class="form-input" id="nordvpnCity" placeholder="{{ _('nordvpn_city_placeholder') }}" autocomplete="off">
+                    </div>
+                    <div style="display:grid; grid-template-columns: 1fr 1fr; gap: var(--space-sm);">
+                        <button type="button" class="btn btn-primary" id="nordvpnConnectBtn" onclick="connectNordvpn()">
+                            <span id="nordvpnConnectBtnText">{{ _('nordvpn_connect') }}</span>
+                            <div class="spinner hidden" id="nordvpnConnectSpinner" style="width:14px; height:14px;"></div>
+                        </button>
+                        <button type="button" class="btn btn-secondary hidden" id="nordvpnDisconnectBtn" onclick="disconnectNordvpn()">
+                            <span id="nordvpnDisconnectBtnText">{{ _('nordvpn_disconnect') }}</span>
+                            <div class="spinner hidden" id="nordvpnDisconnectSpinner" style="width:14px; height:14px;"></div>
+                        </button>
+                    </div>
+                </div>
             </div>
             <p class="form-hint" style="margin-top: var(--space-md);">{{ _('tunnels_hint') }}</p>
         </div>
@@ -597,15 +621,24 @@
                     <!-- Updated via JS -->
                 </div>
 
-                <div style="display: flex; gap: var(--space-sm); margin-top: var(--space-sm);">
-                    <button type="button" class="btn btn-secondary" onclick="checkForUpdates()" id="checkUpdateBtn" style="flex:1;">
+                <div style="display: flex; gap: var(--space-sm); margin-top: var(--space-sm); flex-wrap: wrap;">
+                    <button type="button" class="btn btn-primary" onclick="upgradePanel()" id="upgradePanelBtn" style="flex:1; min-width:180px;">
+                        <span id="upgradePanelBtnText">⬆ {{ _('upgrade_panel') }}</span>
+                        <div class="spinner hidden" id="upgradePanelSpinner" style="width:14px; height:14px;"></div>
+                    </button>
+                    <button type="button" class="btn btn-secondary" onclick="checkForUpdates()" id="checkUpdateBtn" style="flex:1; min-width:140px;">
                         <span id="checkUpdateBtnText">🔄 {{ _('check_updates') }}</span>
                         <div class="spinner hidden" id="checkUpdateSpinner" style="width:14px; height:14px;"></div>
                     </button>
-                    <a href="https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases" target="_blank" class="btn btn-primary hidden" id="downloadUpdateBtn" style="flex:1; text-decoration: none; justify-content: center;">
+                    <button type="button" class="btn btn-secondary hidden" onclick="applyPanelUpdate()" id="applyUpdateBtn" style="flex:1; min-width:140px;">
+                        <span id="applyUpdateBtnText">⬆ {{ _('apply_update') }}</span>
+                        <div class="spinner hidden" id="applyUpdateSpinner" style="width:14px; height:14px;"></div>
+                    </button>
+                    <a href="https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases" target="_blank" class="btn btn-secondary hidden" id="downloadUpdateBtn" style="flex:1; min-width:140px; text-decoration: none; justify-content: center;">
                         ⬇️ {{ _('download_update') }}
                     </a>
                 </div>
+                <p class="form-hint" id="updateModeHint" style="margin:0;">{{ _('auto_update_hint') }}</p>
             </div>
         </div>
     </div>
@@ -951,6 +984,7 @@
             updateTunnelProvider('cloudflare', data.cloudflare || {});
             updateTunnelProvider('ngrok', data.ngrok || {});
             updateWarpStatus(data.warp || {});
+            updateNordvpnStatus(data.nordvpn || {});
         } catch (err) {
             showToast(`${_('error')}: ` + err.message, 'error');
         }
@@ -1020,6 +1054,81 @@
         }
     }
 
+    function updateNordvpnStatus(status) {
+        const badge = document.getElementById('nordvpnInstallBadge');
+        const statusText = document.getElementById('nordvpnStatusText');
+        const serverText = document.getElementById('nordvpnServerText');
+        const hintText = document.getElementById('nordvpnHintText');
+        const connectBtn = document.getElementById('nordvpnConnectBtn');
+        const disconnectBtn = document.getElementById('nordvpnDisconnectBtn');
+        const connectText = document.getElementById('nordvpnConnectBtnText');
+        if (!badge || !statusText || !connectBtn || !disconnectBtn || !connectText) return;
+
+        const installed = !!status.installed;
+        const connected = !!status.connected || status.status === 'connected';
+        badge.className = connected ? 'badge badge-success' : (installed ? 'badge badge-info' : 'badge badge-secondary');
+        badge.textContent = connected ? _('nordvpn_connected') : (installed ? _('installed') : _('not_installed'));
+
+        const statusKey = `nordvpn_status_${status.status || 'unknown'}`;
+        statusText.textContent = _(statusKey) || status.status || _('nordvpn_status_unknown');
+        if (serverText) {
+            const serverLine = status.server || '';
+            serverText.textContent = serverLine;
+            serverText.classList.toggle('hidden', !serverLine);
+        }
+        hintText.textContent = status.last_error || (installed ? _('nordvpn_hint') : (status.install_hint || _('nordvpn_install_hint')));
+        connectText.textContent = installed ? _('nordvpn_connect') : _('nordvpn_install_required');
+        connectBtn.disabled = connected;
+        disconnectBtn.classList.toggle('hidden', !connected);
+    }
+
+    async function connectNordvpn() {
+        const btn = document.getElementById('nordvpnConnectBtn');
+        const spinner = document.getElementById('nordvpnConnectSpinner');
+        const text = document.getElementById('nordvpnConnectBtnText');
+        btn.disabled = true;
+        spinner.classList.remove('hidden');
+        text.textContent = _('loading');
+
+        try {
+            const country = (document.getElementById('nordvpnCountry') || {}).value || '';
+            const city = (document.getElementById('nordvpnCity') || {}).value || '';
+            const status = await apiCall('/api/settings/nordvpn/connect', 'POST', {
+                country: country.trim(),
+                city: city.trim(),
+            });
+            updateNordvpnStatus(status);
+            showToast(_('nordvpn_connected'), 'success');
+        } catch (err) {
+            showToast(`${_('error')}: ` + err.message, 'error');
+            await loadTunnelStatus();
+        } finally {
+            spinner.classList.add('hidden');
+        }
+    }
+
+    async function disconnectNordvpn() {
+        const btn = document.getElementById('nordvpnDisconnectBtn');
+        const spinner = document.getElementById('nordvpnDisconnectSpinner');
+        const text = document.getElementById('nordvpnDisconnectBtnText');
+        btn.disabled = true;
+        spinner.classList.remove('hidden');
+        text.textContent = _('loading');
+
+        try {
+            const status = await apiCall('/api/settings/nordvpn/disconnect', 'POST');
+            updateNordvpnStatus(status);
+            showToast(_('nordvpn_disconnected'), 'success');
+        } catch (err) {
+            showToast(`${_('error')}: ` + err.message, 'error');
+            await loadTunnelStatus();
+        } finally {
+            btn.disabled = false;
+            text.textContent = _('nordvpn_disconnect');
+            spinner.classList.add('hidden');
+        }
+    }
+
     async function enableTunnel(provider) {
         const btn = document.getElementById(`${provider}TunnelBtn`);
         const spinner = document.getElementById(`${provider}TunnelSpinner`);
@@ -1482,42 +1591,141 @@
         updateProtocolsForSync();
     }
 
-    async function checkForUpdates() {
+    let latestUpdateInfo = null;
+
+    async function checkForUpdates(silent) {
         const btn = document.getElementById('checkUpdateBtn');
         const text = document.getElementById('checkUpdateBtnText');
         const spinner = document.getElementById('checkUpdateSpinner');
         const statusDiv = document.getElementById('updateStatus');
         const downloadBtn = document.getElementById('downloadUpdateBtn');
-        
-        btn.disabled = true;
-        text.textContent = "{{ _('checking_updates')|default('Checking...') }}";
-        spinner.classList.remove('hidden');
+        const applyBtn = document.getElementById('applyUpdateBtn');
+        const modeHint = document.getElementById('updateModeHint');
+
+        if (!silent) {
+            btn.disabled = true;
+            text.textContent = "{{ _('checking_updates')|default('Checking...') }}";
+            spinner.classList.remove('hidden');
+        }
         statusDiv.classList.add('hidden');
         downloadBtn.classList.add('hidden');
+        applyBtn.classList.add('hidden');
 
         try {
             const data = await apiCall('/api/settings/check_updates');
+            latestUpdateInfo = data;
             const latestVersion = data.latest_version || '';
             statusDiv.classList.remove('hidden');
-            
+
+            if (modeHint) {
+                const method = data.update_mode || (data.mode && data.mode.update_method) || (data.mode && data.mode.mode) || '';
+                if (!data.can_auto_update) {
+                    if (method === 'docker') {
+                        modeHint.textContent = "{{ _('auto_update_docker')|default('Docker: on the host run git pull && docker compose up -d --build.') }}";
+                    } else {
+                        modeHint.textContent = "{{ _('auto_update_manual')|default('One-click update needs a writable install directory or git clone.') }}";
+                    }
+                } else if (method === 'archive') {
+                    modeHint.textContent = "{{ _('auto_update_archive')|default('One-click update downloads the release ZIP from git.evilfox.cc and restarts the panel.') }}";
+                } else {
+                    modeHint.textContent = "{{ _('auto_update_ready')|default('Git auto-update is available for this install.') }}";
+                }
+            }
+
+            const upgradeBtn = document.getElementById('upgradePanelBtn');
+            if (upgradeBtn) {
+                upgradeBtn.disabled = !data.can_auto_update;
+                upgradeBtn.title = data.can_auto_update ? '' : (modeHint ? modeHint.textContent : '');
+            }
+
             if (data.update_available && latestVersion) {
                 statusDiv.innerHTML = `<span style="color: var(--success); font-weight: bold;">{{ _('update_available')|default('Update available') }}: ${latestVersion}</span>`;
                 statusDiv.style.border = '1px solid var(--success)';
                 downloadBtn.href = data.html_url || data.releases_url || 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases';
                 downloadBtn.classList.remove('hidden');
+                if (data.can_auto_update) {
+                    applyBtn.classList.remove('hidden');
+                }
             } else {
                 statusDiv.innerHTML = `<span style="color: var(--text-muted);">{{ _('up_to_date')|default('Up to date') }}</span>`;
                 statusDiv.style.border = '1px solid var(--border-color)';
             }
         } catch (err) {
-            showToast('Failed to check for updates: ' + err.message, 'error');
+            if (!silent) showToast('Failed to check for updates: ' + err.message, 'error');
         } finally {
-            btn.disabled = false;
-            text.textContent = "🔄 {{ _('check_updates')|default('Check for updates') }}";
-            spinner.classList.add('hidden');
+            if (!silent) {
+                btn.disabled = false;
+                text.textContent = "🔄 {{ _('check_updates')|default('Check for updates') }}";
+                spinner.classList.add('hidden');
+            }
         }
     }
 
+    async function applyPanelUpdate() {
+        const applyBtn = document.getElementById('applyUpdateBtn');
+        const applyText = document.getElementById('applyUpdateBtnText');
+        const applySpinner = document.getElementById('applyUpdateSpinner');
+        const target = (latestUpdateInfo && latestUpdateInfo.latest_version) || '';
+        if (!target) {
+            showToast("{{ _('update_no_target')|default('No target version. Check for updates first.') }}", 'error');
+            return;
+        }
+        if (!confirm("{{ _('apply_update_confirm')|default('Install update from git.evilfox.cc and restart the panel?') }} " + target)) {
+            return;
+        }
+        applyBtn.disabled = true;
+        applyText.textContent = "{{ _('applying_update')|default('Updating…') }}";
+        applySpinner.classList.remove('hidden');
+        try {
+            const data = await apiCall('/api/settings/apply_update', 'POST', {
+                target_version: target,
+                allow_dirty: true,
+            });
+            showToast(data.message || "{{ _('update_restarting')|default('Updated. Restarting…') }}", 'success');
+            setTimeout(() => { window.location.reload(); }, 3500);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+            applyBtn.disabled = false;
+            applyText.textContent = "⬆ {{ _('apply_update')|default('Install update') }}";
+            applySpinner.classList.add('hidden');
+        }
+    }
+
+    async function upgradePanel() {
+        const btn = document.getElementById('upgradePanelBtn');
+        const text = document.getElementById('upgradePanelBtnText');
+        const spinner = document.getElementById('upgradePanelSpinner');
+        const latest = (latestUpdateInfo && latestUpdateInfo.latest_version) || '';
+        const confirmMsg = latest
+            ? ("{{ _('upgrade_panel_confirm')|default('Download and install') }} " + latest + "?")
+            : "{{ _('upgrade_panel_confirm_latest')|default('Check for updates and install the latest release?') }}";
+        if (!confirm(confirmMsg)) return;
+
+        btn.disabled = true;
+        spinner.classList.remove('hidden');
+        text.textContent = "{{ _('upgrade_panel_working')|default('Updating panel…') }}";
+        try {
+            const data = await apiCall('/api/settings/upgrade_panel', 'POST', {});
+            if (data.up_to_date) {
+                showToast("{{ _('upgrade_panel_up_to_date')|default('Already on the latest version') }}", 'info');
+                await checkForUpdates(true);
+                return;
+            }
+            showToast(data.message || "{{ _('update_restarting')|default('Updated. Restarting…') }}", 'success');
+            setTimeout(() => { window.location.reload(); }, 4000);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+            await checkForUpdates(true);
+        } finally {
+            btn.disabled = false;
+            spinner.classList.add('hidden');
+            text.textContent = "⬆ {{ _('upgrade_panel')|default('Update panel') }}";
+        }
+    }
+
+    // Auto-check once on Settings load
+    setTimeout(() => checkForUpdates(true), 800);
+
     /* ========== API Tokens ========== */
 
     function fmtTokenDate(iso) {

translations/en.json

@@ -1,4 +1,4 @@
-{
+{
     "nav_servers":  "Servers",
     "nav_users":  "Users",
     "nav_invites":  "Invite links",
@@ -481,6 +481,21 @@
     "update_available":  "New version available",
     "download_update":  "Download update",
     "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a writable install directory or git clone. You can still download a release.",
+    "auto_update_archive":  "One-click update downloads the release ZIP from git.evilfox.cc and restarts the panel.",
+    "upgrade_panel":  "Update panel",
+    "upgrade_panel_confirm":  "Download and install",
+    "upgrade_panel_confirm_latest":  "Check for updates and install the latest release?",
+    "upgrade_panel_working":  "Updating panel…",
+    "upgrade_panel_up_to_date":  "Already on the latest version",
     "warp_hint":  "WARP routes this host outbound through Cloudflare. It does not create a public panel URL like Quick Tunnel or ngrok.",
     "warp_install_hint":  "Install the official Cloudflare WARP client first, then restart the panel.",
     "warp_install_required":  "Install WARP first",
@@ -496,6 +511,23 @@
     "warp_status_not_registered":  "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
     "warp_status_service_unavailable":  "Cloudflare WARP service is not available. Make sure warp-svc is running.",
     "warp_status_error":  "Cloudflare WARP returned an error.",
+    "nordvpn_hint":  "NordVPN routes this host outbound through NordVPN servers. It does not create a public panel URL like Quick Tunnel or ngrok. Run nordvpn login on the host once before connecting.",
+    "nordvpn_install_hint":  "Install the official NordVPN client/CLI on this host, run nordvpn login, then restart the panel.",
+    "nordvpn_install_required":  "Install NordVPN first",
+    "nordvpn_connect":  "Connect NordVPN",
+    "nordvpn_disconnect":  "Disconnect",
+    "nordvpn_connected":  "NordVPN connected",
+    "nordvpn_disconnected":  "NordVPN disconnected",
+    "nordvpn_status_unknown":  "NordVPN status is unknown.",
+    "nordvpn_status_not_installed":  "NordVPN CLI is not installed on this host.",
+    "nordvpn_status_connected":  "NordVPN is connected.",
+    "nordvpn_status_connecting":  "NordVPN is connecting.",
+    "nordvpn_status_disconnected":  "NordVPN is disconnected.",
+    "nordvpn_status_not_logged_in":  "NordVPN is installed but not logged in. Run nordvpn login on this host.",
+    "nordvpn_status_service_unavailable":  "NordVPN daemon is not available. Make sure nordvpnd is running.",
+    "nordvpn_status_error":  "NordVPN returned an error.",
+    "nordvpn_country_placeholder":  "Country (optional, e.g. Germany or de)",
+    "nordvpn_city_placeholder":  "City (optional, e.g. Berlin)",
     "install_starting":  "Starting installation...",
     "server_check_complete":  "Check completed",
     "server_connection_error":  "Connection error",
@@ -575,50 +607,5 @@
     "xui_server_name_hint":  "Shown in invites and user forms (e.g. US, NL, Home).",
     "xui_server_select_label":  "3x-ui server",
     "xui_server_select_hint":  "Pick a 3x-ui panel, then an inbound from the list that panel returns via API.",
-    "xui_server_delete_confirm":  "Delete this 3x-ui server from the panel?",
-    "cascade_title":  "Cascade (double VPN)",
-    "cascade_desc":  "Clients connect to this entry server; internet exits through another server — to bypass country blocks.",
-    "cascade_hint":  "ryderams-style AWG2 cascade: entry and exit must both have AmneziaWG/WireGuard. Clients keep using the ENTRY config only.",
-    "cascade_client_note":  "Users connect only to the ENTRY server. Do not give them the exit cascade peer.",
-    "cascade_security_note":  "Logic runs via panel SSH (no remote curl|bash). Based on ryderams/amneziawg-cascade approach.",
-    "cascade_entry_protocol":  "Protocol on this server (entry)",
-    "cascade_exit_server":  "Exit server",
-    "cascade_exit_server_none":  "— Select server —",
-    "cascade_exit_protocol":  "Protocol on exit server",
-    "cascade_enable":  "Enable cascade",
-    "cascade_disable":  "Disable cascade",
-    "cascade_working":  "Setting up cascade…",
-    "cascade_disabling":  "Disabling cascade…",
-    "cascade_enabled":  "Cascade enabled",
-    "cascade_disabled":  "Cascade disabled",
-    "cascade_off":  "Off",
-    "cascade_on":  "Active",
-    "cascade_configured_down":  "Configured, tunnel down",
-    "cascade_exit_required":  "Select an exit server",
-    "cascade_enable_confirm":  "Enable cascade? A service client will be created on the exit server and a tunnel will be set up on this entry server.",
-    "cascade_disable_confirm":  "Disable cascade on this server?",
-    "cascade_no_handshake":  "Up, no handshake",
-    "cascade_settings_title":  "Cascade settings (per step)",
-    "cascade_settings_desc":  "If pages spin forever with no internet — keep all options on and click Enable cascade again.",
-    "cascade_opt_pin_exit":  "Pin route to exit server",
-    "cascade_opt_pin_exit_hint":  "Keeps the exit tunnel from looping through the VPN itself.",
-    "cascade_opt_remove_eth_masq":  "Remove client NAT on eth0",
-    "cascade_opt_remove_eth_masq_hint":  "Clients must not egress directly from the entry server.",
-    "cascade_opt_force_forward":  "Force FORWARD between interfaces",
-    "cascade_opt_force_forward_hint":  "Client traffic → cascade → exit.",
-    "cascade_opt_mss_clamp":  "TCP MSS clamp",
-    "cascade_opt_mss_clamp_hint":  "Fixes endless page loads on double VPN.",
-    "cascade_opt_wait_handshake":  "Wait for exit handshake",
-    "cascade_opt_wait_handshake_hint":  "Do not mark cascade active if the exit peer never answers.",
-    "cascade_verify_egress":  "Verify egress IP",
-    "cascade_verify_egress_hint":  "After handshake, verify policy route from awg0 IP via cascade, then curl public-IP services. Soft-warn if curl fails but route is OK.",
-    "cascade_opt_keep_dns":  "Keep DNS from exit config",
-    "cascade_opt_keep_dns_hint":  "Usually off — the client sets DNS itself.",
-    "cascade_opt_handshake_timeout":  "Handshake timeout (sec)",
-    "cascade_opt_table_id":  "Routing table id",
-    "cascade_opt_rule_priority":  "ip rule priority",
-    "cascade_opt_allowed_ips":  "AllowedIPs for entry→exit tunnel",
-    "cascade_opt_allowed_ips_hint":  "Prefer 0.0.0.0/0 (IPv4); ::/0 often breaks double VPN.",
-    "cascade_opt_vpn_subnet":  "Client subnet override",
-    "cascade_opt_vpn_subnet_hint":  "Empty = auto-detect from server Address"
+    "xui_server_delete_confirm":  "Delete this 3x-ui server from the panel?"
 }

translations/fa.json

@@ -1,4 +1,4 @@
-{
+{
     "nav_servers":  "سرورها",
     "nav_users":  "کاربران",
     "nav_invites":  "لینک دعوت",
@@ -448,6 +448,23 @@
     "warp_status_not_registered":  "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
     "warp_status_service_unavailable":  "Cloudflare WARP service is not available. Make sure warp-svc is running.",
     "warp_status_error":  "Cloudflare WARP returned an error.",
+    "nordvpn_hint":  "NordVPN routes this host outbound through NordVPN servers. It does not create a public panel URL like Quick Tunnel or ngrok. Run nordvpn login on the host once before connecting.",
+    "nordvpn_install_hint":  "Install the official NordVPN client/CLI on this host, run nordvpn login, then restart the panel.",
+    "nordvpn_install_required":  "Install NordVPN first",
+    "nordvpn_connect":  "Connect NordVPN",
+    "nordvpn_disconnect":  "Disconnect",
+    "nordvpn_connected":  "NordVPN connected",
+    "nordvpn_disconnected":  "NordVPN disconnected",
+    "nordvpn_status_unknown":  "NordVPN status is unknown.",
+    "nordvpn_status_not_installed":  "NordVPN CLI is not installed on this host.",
+    "nordvpn_status_connected":  "NordVPN is connected.",
+    "nordvpn_status_connecting":  "NordVPN is connecting.",
+    "nordvpn_status_disconnected":  "NordVPN is disconnected.",
+    "nordvpn_status_not_logged_in":  "NordVPN is installed but not logged in. Run nordvpn login on this host.",
+    "nordvpn_status_service_unavailable":  "NordVPN daemon is not available. Make sure nordvpnd is running.",
+    "nordvpn_status_error":  "NordVPN returned an error.",
+    "nordvpn_country_placeholder":  "Country (optional, e.g. Germany or de)",
+    "nordvpn_city_placeholder":  "City (optional, e.g. Berlin)",
     "install_starting":  "Starting installation...",
     "server_check_complete":  "Check completed",
     "server_connection_error":  "Connection error",
@@ -518,50 +535,28 @@
     "xui_server_name_hint":  "در دعوت‌ها نمایش داده می‌شود (مثل US، NL).",
     "xui_server_select_label":  "سرور 3x-ui",
     "xui_server_select_hint":  "پنل 3x-ui که URL اشتراک می‌دهد را انتخاب کنید.",
-    "xui_server_delete_confirm":  "این سرور 3x-ui حذف شود؟",
-    "cascade_title":  "Cascade (double VPN)",
-    "cascade_desc":  "Clients connect to this entry server; internet exits through another server — to bypass country blocks.",
-    "cascade_hint":  "ryderams-style AWG2 cascade: entry and exit must both have AmneziaWG/WireGuard. Clients keep using the ENTRY config only.",
-    "cascade_client_note":  "Users connect only to the ENTRY server. Do not give them the exit cascade peer.",
-    "cascade_security_note":  "Logic runs via panel SSH (no remote curl|bash). Based on ryderams/amneziawg-cascade approach.",
-    "cascade_entry_protocol":  "Protocol on this server (entry)",
-    "cascade_exit_server":  "Exit server",
-    "cascade_exit_server_none":  "— Select server —",
-    "cascade_exit_protocol":  "Protocol on exit server",
-    "cascade_enable":  "Enable cascade",
-    "cascade_disable":  "Disable cascade",
-    "cascade_working":  "Setting up cascade…",
-    "cascade_disabling":  "Disabling cascade…",
-    "cascade_enabled":  "Cascade enabled",
-    "cascade_disabled":  "Cascade disabled",
-    "cascade_off":  "Off",
-    "cascade_on":  "Active",
-    "cascade_configured_down":  "Configured, tunnel down",
-    "cascade_exit_required":  "Select an exit server",
-    "cascade_enable_confirm":  "Enable cascade? A service client will be created on the exit server and a tunnel will be set up on this entry server.",
-    "cascade_disable_confirm":  "Disable cascade on this server?",
-    "cascade_no_handshake":  "Up, no handshake",
-    "cascade_settings_title":  "Cascade settings (per step)",
-    "cascade_settings_desc":  "If pages spin forever with no internet — keep all options on and click Enable cascade again.",
-    "cascade_opt_pin_exit":  "Pin route to exit server",
-    "cascade_opt_pin_exit_hint":  "Keeps the exit tunnel from looping through the VPN itself.",
-    "cascade_opt_remove_eth_masq":  "Remove client NAT on eth0",
-    "cascade_opt_remove_eth_masq_hint":  "Clients must not egress directly from the entry server.",
-    "cascade_opt_force_forward":  "Force FORWARD between interfaces",
-    "cascade_opt_force_forward_hint":  "Client traffic → cascade → exit.",
-    "cascade_opt_mss_clamp":  "TCP MSS clamp",
-    "cascade_opt_mss_clamp_hint":  "Fixes endless page loads on double VPN.",
-    "cascade_opt_wait_handshake":  "Wait for exit handshake",
-    "cascade_opt_wait_handshake_hint":  "Do not mark cascade active if the exit peer never answers.",
-    "cascade_verify_egress":  "Verify egress IP",
-    "cascade_verify_egress_hint":  "After handshake, verify policy route from awg0 IP via cascade, then curl public-IP services. Soft-warn if curl fails but route is OK.",
-    "cascade_opt_keep_dns":  "Keep DNS from exit config",
-    "cascade_opt_keep_dns_hint":  "Usually off — the client sets DNS itself.",
-    "cascade_opt_handshake_timeout":  "Handshake timeout (sec)",
-    "cascade_opt_table_id":  "Routing table id",
-    "cascade_opt_rule_priority":  "ip rule priority",
-    "cascade_opt_allowed_ips":  "AllowedIPs for entry→exit tunnel",
-    "cascade_opt_allowed_ips_hint":  "Prefer 0.0.0.0/0 (IPv4); ::/0 often breaks double VPN.",
-    "cascade_opt_vpn_subnet":  "Client subnet override",
-    "cascade_opt_vpn_subnet_hint":  "Empty = auto-detect from server Address"
+    "xui_server_delete_confirm":  "این سرور 3x-ui حذف شود؟"
+,
+    "about_title":  "About & Updates",
+    "current_version":  "Current version",
+    "check_updates":  "Check for updates",
+    "checking_updates":  "Checking...",
+    "update_available":  "New version available",
+    "download_update":  "Download update",
+    "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release.",
+    "auto_update_archive":  "One-click update downloads the release ZIP from git.evilfox.cc and restarts the panel.",
+    "upgrade_panel":  "Update panel",
+    "upgrade_panel_confirm":  "Download and install",
+    "upgrade_panel_confirm_latest":  "Check for updates and install the latest release?",
+    "upgrade_panel_working":  "Updating panel…",
+    "upgrade_panel_up_to_date":  "Already on the latest version"
 }

translations/fr.json

@@ -1,4 +1,4 @@
-{
+{
     "nav_servers":  "Serveurs",
     "nav_users":  "Utilisateurs",
     "nav_invites":  "Liens d\u0027invitation",
@@ -448,6 +448,23 @@
     "warp_status_not_registered":  "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
     "warp_status_service_unavailable":  "Cloudflare WARP service is not available. Make sure warp-svc is running.",
     "warp_status_error":  "Cloudflare WARP returned an error.",
+    "nordvpn_hint":  "NordVPN routes this host outbound through NordVPN servers. It does not create a public panel URL like Quick Tunnel or ngrok. Run nordvpn login on the host once before connecting.",
+    "nordvpn_install_hint":  "Install the official NordVPN client/CLI on this host, run nordvpn login, then restart the panel.",
+    "nordvpn_install_required":  "Install NordVPN first",
+    "nordvpn_connect":  "Connect NordVPN",
+    "nordvpn_disconnect":  "Disconnect",
+    "nordvpn_connected":  "NordVPN connected",
+    "nordvpn_disconnected":  "NordVPN disconnected",
+    "nordvpn_status_unknown":  "NordVPN status is unknown.",
+    "nordvpn_status_not_installed":  "NordVPN CLI is not installed on this host.",
+    "nordvpn_status_connected":  "NordVPN is connected.",
+    "nordvpn_status_connecting":  "NordVPN is connecting.",
+    "nordvpn_status_disconnected":  "NordVPN is disconnected.",
+    "nordvpn_status_not_logged_in":  "NordVPN is installed but not logged in. Run nordvpn login on this host.",
+    "nordvpn_status_service_unavailable":  "NordVPN daemon is not available. Make sure nordvpnd is running.",
+    "nordvpn_status_error":  "NordVPN returned an error.",
+    "nordvpn_country_placeholder":  "Country (optional, e.g. Germany or de)",
+    "nordvpn_city_placeholder":  "City (optional, e.g. Berlin)",
     "install_starting":  "Starting installation...",
     "server_check_complete":  "Check completed",
     "server_connection_error":  "Connection error",
@@ -518,50 +535,28 @@
     "xui_server_name_hint":  "Affiché dans les invitations (ex: US, NL).",
     "xui_server_select_label":  "Serveur 3x-ui",
     "xui_server_select_hint":  "Choisissez le panneau 3x-ui qui émettra l\u0027URL d\u0027abonnement.",
-    "xui_server_delete_confirm":  "Supprimer ce serveur 3x-ui ?",
-    "cascade_title":  "Cascade (double VPN)",
-    "cascade_desc":  "Clients connect to this entry server; internet exits through another server — to bypass country blocks.",
-    "cascade_hint":  "ryderams-style AWG2 cascade: entry and exit must both have AmneziaWG/WireGuard. Clients keep using the ENTRY config only.",
-    "cascade_client_note":  "Users connect only to the ENTRY server. Do not give them the exit cascade peer.",
-    "cascade_security_note":  "Logic runs via panel SSH (no remote curl|bash). Based on ryderams/amneziawg-cascade approach.",
-    "cascade_entry_protocol":  "Protocol on this server (entry)",
-    "cascade_exit_server":  "Exit server",
-    "cascade_exit_server_none":  "— Select server —",
-    "cascade_exit_protocol":  "Protocol on exit server",
-    "cascade_enable":  "Enable cascade",
-    "cascade_disable":  "Disable cascade",
-    "cascade_working":  "Setting up cascade…",
-    "cascade_disabling":  "Disabling cascade…",
-    "cascade_enabled":  "Cascade enabled",
-    "cascade_disabled":  "Cascade disabled",
-    "cascade_off":  "Off",
-    "cascade_on":  "Active",
-    "cascade_configured_down":  "Configured, tunnel down",
-    "cascade_exit_required":  "Select an exit server",
-    "cascade_enable_confirm":  "Enable cascade? A service client will be created on the exit server and a tunnel will be set up on this entry server.",
-    "cascade_disable_confirm":  "Disable cascade on this server?",
-    "cascade_no_handshake":  "Up, no handshake",
-    "cascade_settings_title":  "Cascade settings (per step)",
-    "cascade_settings_desc":  "If pages spin forever with no internet — keep all options on and click Enable cascade again.",
-    "cascade_opt_pin_exit":  "Pin route to exit server",
-    "cascade_opt_pin_exit_hint":  "Keeps the exit tunnel from looping through the VPN itself.",
-    "cascade_opt_remove_eth_masq":  "Remove client NAT on eth0",
-    "cascade_opt_remove_eth_masq_hint":  "Clients must not egress directly from the entry server.",
-    "cascade_opt_force_forward":  "Force FORWARD between interfaces",
-    "cascade_opt_force_forward_hint":  "Client traffic → cascade → exit.",
-    "cascade_opt_mss_clamp":  "TCP MSS clamp",
-    "cascade_opt_mss_clamp_hint":  "Fixes endless page loads on double VPN.",
-    "cascade_opt_wait_handshake":  "Wait for exit handshake",
-    "cascade_opt_wait_handshake_hint":  "Do not mark cascade active if the exit peer never answers.",
-    "cascade_verify_egress":  "Verify egress IP",
-    "cascade_verify_egress_hint":  "After handshake, verify policy route from awg0 IP via cascade, then curl public-IP services. Soft-warn if curl fails but route is OK.",
-    "cascade_opt_keep_dns":  "Keep DNS from exit config",
-    "cascade_opt_keep_dns_hint":  "Usually off — the client sets DNS itself.",
-    "cascade_opt_handshake_timeout":  "Handshake timeout (sec)",
-    "cascade_opt_table_id":  "Routing table id",
-    "cascade_opt_rule_priority":  "ip rule priority",
-    "cascade_opt_allowed_ips":  "AllowedIPs for entry→exit tunnel",
-    "cascade_opt_allowed_ips_hint":  "Prefer 0.0.0.0/0 (IPv4); ::/0 often breaks double VPN.",
-    "cascade_opt_vpn_subnet":  "Client subnet override",
-    "cascade_opt_vpn_subnet_hint":  "Empty = auto-detect from server Address"
+    "xui_server_delete_confirm":  "Supprimer ce serveur 3x-ui ?"
+,
+    "about_title":  "About & Updates",
+    "current_version":  "Current version",
+    "check_updates":  "Check for updates",
+    "checking_updates":  "Checking...",
+    "update_available":  "New version available",
+    "download_update":  "Download update",
+    "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release.",
+    "auto_update_archive":  "One-click update downloads the release ZIP from git.evilfox.cc and restarts the panel.",
+    "upgrade_panel":  "Update panel",
+    "upgrade_panel_confirm":  "Download and install",
+    "upgrade_panel_confirm_latest":  "Check for updates and install the latest release?",
+    "upgrade_panel_working":  "Updating panel…",
+    "upgrade_panel_up_to_date":  "Already on the latest version"
 }

translations/ru.json

@@ -1,4 +1,4 @@
-{
+{
     "nav_servers":  "Серверы",
     "nav_users":  "Пользователи",
     "nav_invites":  "Ссылки",
@@ -481,6 +481,21 @@
     "update_available":  "Доступна новая версия",
     "download_update":  "Скачать обновление",
     "up_to_date":  "У вас установлена последняя версия",
+    "apply_update":  "Установить обновление",
+    "applying_update":  "Обновление…",
+    "apply_update_confirm":  "Установить обновление с git.evilfox.cc и перезапустить панель?",
+    "update_restarting":  "Обновлено. Перезапуск панели…",
+    "update_no_target":  "Нет целевой версии. Сначала проверьте обновления.",
+    "auto_update_hint":  "Автообновление тянет тег релиза с git.evilfox.cc (нужен git clone панели).",
+    "auto_update_ready":  "Для этой установки доступно автообновление через git.",
+    "auto_update_docker":  "Docker: пересоберите/подтяните образ или используйте git clone для обновления в один клик.",
+    "auto_update_manual":  "Обновление в один клик требует git clone или каталог с правами записи. Можно скачать релиз вручную.",
+    "auto_update_archive":  "Обновление в один клик: скачивает ZIP релиза с git.evilfox.cc и перезапускает панель.",
+    "upgrade_panel":  "Обновить панель",
+    "upgrade_panel_confirm":  "Скачать и установить",
+    "upgrade_panel_confirm_latest":  "Проверить обновления и установить последний релиз?",
+    "upgrade_panel_working":  "Обновление панели…",
+    "upgrade_panel_up_to_date":  "Уже установлена последняя версия",
     "warp_hint":  "WARP направляет исходящий трафик этого хоста через Cloudflare. Он не создаёт публичный URL панели как Quick Tunnel или ngrok.",
     "warp_install_hint":  "Сначала установите официальный клиент Cloudflare WARP, затем перезапустите панель.",
     "warp_install_required":  "Сначала установите WARP",
@@ -496,6 +511,23 @@
     "warp_status_not_registered":  "Cloudflare WARP установлен, но ещё не зарегистрирован. Подключение попробует зарегистрировать его автоматически.",
     "warp_status_service_unavailable":  "Сервис Cloudflare WARP недоступен. Убедитесь, что warp-svc запущен.",
     "warp_status_error":  "Cloudflare WARP вернул ошибку.",
+    "nordvpn_hint":  "NordVPN направляет исходящий трафик этого хоста через серверы NordVPN. Не создаёт публичный URL панели как Quick Tunnel или ngrok. Перед подключением один раз выполните nordvpn login на хосте.",
+    "nordvpn_install_hint":  "Установите официальный клиент/CLI NordVPN на этом хосте, выполните nordvpn login и перезапустите панель.",
+    "nordvpn_install_required":  "Сначала установите NordVPN",
+    "nordvpn_connect":  "Подключить NordVPN",
+    "nordvpn_disconnect":  "Отключить",
+    "nordvpn_connected":  "NordVPN подключён",
+    "nordvpn_disconnected":  "NordVPN отключён",
+    "nordvpn_status_unknown":  "Статус NordVPN неизвестен.",
+    "nordvpn_status_not_installed":  "CLI NordVPN не установлен на этом хосте.",
+    "nordvpn_status_connected":  "NordVPN подключён.",
+    "nordvpn_status_connecting":  "NordVPN подключается.",
+    "nordvpn_status_disconnected":  "NordVPN отключён.",
+    "nordvpn_status_not_logged_in":  "NordVPN установлен, но не выполнен вход. Запустите nordvpn login на хосте.",
+    "nordvpn_status_service_unavailable":  "Демон NordVPN недоступен. Убедитесь, что nordvpnd запущен.",
+    "nordvpn_status_error":  "NordVPN вернул ошибку.",
+    "nordvpn_country_placeholder":  "Страна (необяз., напр. Germany или de)",
+    "nordvpn_city_placeholder":  "Город (необяз., напр. Berlin)",
     "install_starting":  "Начинаем установку...",
     "server_check_complete":  "Проверка завершена",
     "server_connection_error":  "Ошибка подключения",
@@ -575,50 +607,5 @@
     "xui_server_name_hint":  "Так сервер будет отображаться в инвайтах и у пользователей (например: US, NL, Home).",
     "xui_server_select_label":  "Сервер 3x-ui",
     "xui_server_select_hint":  "Выберите панель 3x-ui, затем inbound из списка, который она отдаёт по API.",
-    "xui_server_delete_confirm":  "Удалить этот сервер 3x-ui из панели?",
-    "cascade_title":  "Каскад (двойной VPN)",
-    "cascade_desc":  "Клиенты подключаются к этому серверу (вход), а интернет выходит через другой сервер (выход) — чтобы обойти блокировку страны.",
-    "cascade_hint":  "Каскад в стиле ryderams (AWG2): на входе и выходе должен быть AmneziaWG/WireGuard. Клиенты продолжают использовать только конфиг ВХОДНОГО сервера.",
-    "cascade_client_note":  "Пользователи подключаются только к ВХОДНОМУ серверу. Не выдавайте им служебный peer выхода.",
-    "cascade_security_note":  "Логика выполняется через SSH панели (без удалённого curl|bash). Подход на основе ryderams/amneziawg-cascade.",
-    "cascade_entry_protocol":  "Протокол на этом сервере (вход)",
-    "cascade_exit_server":  "Сервер выхода",
-    "cascade_exit_server_none":  "— Выберите сервер —",
-    "cascade_exit_protocol":  "Протокол на сервере выхода",
-    "cascade_enable":  "Включить каскад",
-    "cascade_disable":  "Отключить каскад",
-    "cascade_working":  "Настраиваю каскад…",
-    "cascade_disabling":  "Отключаю каскад…",
-    "cascade_enabled":  "Каскад включён",
-    "cascade_disabled":  "Каскад отключён",
-    "cascade_off":  "Выключен",
-    "cascade_on":  "Активен",
-    "cascade_configured_down":  "Настроен, туннель вниз",
-    "cascade_exit_required":  "Выберите сервер выхода",
-    "cascade_enable_confirm":  "Включить каскад? На выходном сервере будет создан служебный клиент, а на этом — туннель к нему.",
-    "cascade_disable_confirm":  "Отключить каскад на этом сервере?",
-    "cascade_no_handshake":  "Туннель вверх, нет handshake",
-    "cascade_settings_title":  "Настройки каскада (по шагам)",
-    "cascade_settings_desc":  "Если страницы «крутятся», а интернета нет — оставьте все галочки включёнными и снова нажмите «Включить каскад».",
-    "cascade_opt_pin_exit":  "Закрепить маршрут к серверу выхода",
-    "cascade_opt_pin_exit_hint":  "Чтобы туннель к выходу не ушёл в петлю через сам VPN.",
-    "cascade_opt_remove_eth_masq":  "Убрать NAT клиентов в eth0",
-    "cascade_opt_remove_eth_masq_hint":  "Клиенты не должны выходить в интернет напрямую с входного сервера.",
-    "cascade_opt_force_forward":  "Разрешить FORWARD между интерфейсами",
-    "cascade_opt_force_forward_hint":  "Трафик клиентов → cascade → выход.",
-    "cascade_opt_mss_clamp":  "TCP MSS clamp",
-    "cascade_opt_mss_clamp_hint":  "Чинит «вечную загрузку» сайтов при двойном VPN.",
-    "cascade_opt_wait_handshake":  "Ждать handshake с выходом",
-    "cascade_opt_wait_handshake_hint":  "Не помечать каскад «активным», если выход не отвечает.",
-    "cascade_verify_egress":  "Проверять внешний IP",
-    "cascade_verify_egress_hint":  "После handshake — проверка policy route с IP awg0 через cascade, затем curl. При сбое curl (при OK маршруте) — предупреждение, не откат.",
-    "cascade_opt_keep_dns":  "Оставить DNS из конфига выхода",
-    "cascade_opt_keep_dns_hint":  "Обычно выключено — DNS берёт клиент сам.",
-    "cascade_opt_handshake_timeout":  "Таймаут handshake (сек)",
-    "cascade_opt_table_id":  "Таблица маршрутов",
-    "cascade_opt_rule_priority":  "Приоритет ip rule",
-    "cascade_opt_allowed_ips":  "AllowedIPs туннеля вход→выход",
-    "cascade_opt_allowed_ips_hint":  "Лучше 0.0.0.0/0 (IPv4); ::/0 часто ломает двойной VPN.",
-    "cascade_opt_vpn_subnet":  "Подсеть клиентов (override)",
-    "cascade_opt_vpn_subnet_hint":  "Пусто = определить автоматически из Address сервера"
+    "xui_server_delete_confirm":  "Удалить этот сервер 3x-ui из панели?"
 }

translations/zh.json

@@ -1,4 +1,4 @@
-{
+{
     "nav_servers":  "服务器",
     "nav_users":  "用户列表",
     "nav_invites":  "邀请链接",
@@ -448,6 +448,23 @@
     "warp_status_not_registered":  "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
     "warp_status_service_unavailable":  "Cloudflare WARP service is not available. Make sure warp-svc is running.",
     "warp_status_error":  "Cloudflare WARP returned an error.",
+    "nordvpn_hint":  "NordVPN routes this host outbound through NordVPN servers. It does not create a public panel URL like Quick Tunnel or ngrok. Run nordvpn login on the host once before connecting.",
+    "nordvpn_install_hint":  "Install the official NordVPN client/CLI on this host, run nordvpn login, then restart the panel.",
+    "nordvpn_install_required":  "Install NordVPN first",
+    "nordvpn_connect":  "Connect NordVPN",
+    "nordvpn_disconnect":  "Disconnect",
+    "nordvpn_connected":  "NordVPN connected",
+    "nordvpn_disconnected":  "NordVPN disconnected",
+    "nordvpn_status_unknown":  "NordVPN status is unknown.",
+    "nordvpn_status_not_installed":  "NordVPN CLI is not installed on this host.",
+    "nordvpn_status_connected":  "NordVPN is connected.",
+    "nordvpn_status_connecting":  "NordVPN is connecting.",
+    "nordvpn_status_disconnected":  "NordVPN is disconnected.",
+    "nordvpn_status_not_logged_in":  "NordVPN is installed but not logged in. Run nordvpn login on this host.",
+    "nordvpn_status_service_unavailable":  "NordVPN daemon is not available. Make sure nordvpnd is running.",
+    "nordvpn_status_error":  "NordVPN returned an error.",
+    "nordvpn_country_placeholder":  "Country (optional, e.g. Germany or de)",
+    "nordvpn_city_placeholder":  "City (optional, e.g. Berlin)",
     "install_starting":  "Starting installation...",
     "server_check_complete":  "Check completed",
     "server_connection_error":  "Connection error",
@@ -518,50 +535,28 @@
     "xui_server_name_hint":  "显示在邀请与用户表单中（如 US、NL）。",
     "xui_server_select_label":  "3x-ui 服务器",
     "xui_server_select_hint":  "选择签发订阅 URL 的 3x-ui 面板。",
-    "xui_server_delete_confirm":  "从面板删除此 3x-ui 服务器？",
-    "cascade_title":  "Cascade (double VPN)",
-    "cascade_desc":  "Clients connect to this entry server; internet exits through another server — to bypass country blocks.",
-    "cascade_hint":  "ryderams-style AWG2 cascade: entry and exit must both have AmneziaWG/WireGuard. Clients keep using the ENTRY config only.",
-    "cascade_client_note":  "Users connect only to the ENTRY server. Do not give them the exit cascade peer.",
-    "cascade_security_note":  "Logic runs via panel SSH (no remote curl|bash). Based on ryderams/amneziawg-cascade approach.",
-    "cascade_entry_protocol":  "Protocol on this server (entry)",
-    "cascade_exit_server":  "Exit server",
-    "cascade_exit_server_none":  "— Select server —",
-    "cascade_exit_protocol":  "Protocol on exit server",
-    "cascade_enable":  "Enable cascade",
-    "cascade_disable":  "Disable cascade",
-    "cascade_working":  "Setting up cascade…",
-    "cascade_disabling":  "Disabling cascade…",
-    "cascade_enabled":  "Cascade enabled",
-    "cascade_disabled":  "Cascade disabled",
-    "cascade_off":  "Off",
-    "cascade_on":  "Active",
-    "cascade_configured_down":  "Configured, tunnel down",
-    "cascade_exit_required":  "Select an exit server",
-    "cascade_enable_confirm":  "Enable cascade? A service client will be created on the exit server and a tunnel will be set up on this entry server.",
-    "cascade_disable_confirm":  "Disable cascade on this server?",
-    "cascade_no_handshake":  "Up, no handshake",
-    "cascade_settings_title":  "Cascade settings (per step)",
-    "cascade_settings_desc":  "If pages spin forever with no internet — keep all options on and click Enable cascade again.",
-    "cascade_opt_pin_exit":  "Pin route to exit server",
-    "cascade_opt_pin_exit_hint":  "Keeps the exit tunnel from looping through the VPN itself.",
-    "cascade_opt_remove_eth_masq":  "Remove client NAT on eth0",
-    "cascade_opt_remove_eth_masq_hint":  "Clients must not egress directly from the entry server.",
-    "cascade_opt_force_forward":  "Force FORWARD between interfaces",
-    "cascade_opt_force_forward_hint":  "Client traffic → cascade → exit.",
-    "cascade_opt_mss_clamp":  "TCP MSS clamp",
-    "cascade_opt_mss_clamp_hint":  "Fixes endless page loads on double VPN.",
-    "cascade_opt_wait_handshake":  "Wait for exit handshake",
-    "cascade_opt_wait_handshake_hint":  "Do not mark cascade active if the exit peer never answers.",
-    "cascade_verify_egress":  "Verify egress IP",
-    "cascade_verify_egress_hint":  "After handshake, verify policy route from awg0 IP via cascade, then curl public-IP services. Soft-warn if curl fails but route is OK.",
-    "cascade_opt_keep_dns":  "Keep DNS from exit config",
-    "cascade_opt_keep_dns_hint":  "Usually off — the client sets DNS itself.",
-    "cascade_opt_handshake_timeout":  "Handshake timeout (sec)",
-    "cascade_opt_table_id":  "Routing table id",
-    "cascade_opt_rule_priority":  "ip rule priority",
-    "cascade_opt_allowed_ips":  "AllowedIPs for entry→exit tunnel",
-    "cascade_opt_allowed_ips_hint":  "Prefer 0.0.0.0/0 (IPv4); ::/0 often breaks double VPN.",
-    "cascade_opt_vpn_subnet":  "Client subnet override",
-    "cascade_opt_vpn_subnet_hint":  "Empty = auto-detect from server Address"
+    "xui_server_delete_confirm":  "从面板删除此 3x-ui 服务器？"
+,
+    "about_title":  "About & Updates",
+    "current_version":  "Current version",
+    "check_updates":  "Check for updates",
+    "checking_updates":  "Checking...",
+    "update_available":  "New version available",
+    "download_update":  "Download update",
+    "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release.",
+    "auto_update_archive":  "One-click update downloads the release ZIP from git.evilfox.cc and restarts the panel.",
+    "upgrade_panel":  "Update panel",
+    "upgrade_panel_confirm":  "Download and install",
+    "upgrade_panel_confirm_latest":  "Check for updates and install the latest release?",
+    "upgrade_panel_working":  "Updating panel…",
+    "upgrade_panel_up_to_date":  "Already on the latest version"
 }