---

cat > /root/xray-cf-isolated.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail

DOMAIN="mainnet.assaxaq.online"
PORT=8443
IMG="teddysun/xray:25.12.8"          # УЖЕ локальный (reality-ezpz), пулл не нужен
NAME="xray-cf"
DIR="/opt/xray-cf"
WSPATH="/$(head -c 24 /dev/urandom | sha256sum | cut -c1-16)"
UUID="$(cat /proc/sys/kernel/random/uuid)"

echo "===== Изолированный Xray VLESS+WS+TLS за Cloudflare | exit=VDS ====="
echo "Image : $IMG (локальная)"
echo "Domain: $DOMAIN   Port: $PORT"
echo

echo "[1/6] Проверки (существующее не трогаю)..."
docker info >/dev/null 2>&1 || { echo "[!] Docker не запущен"; exit 1; }
if ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]"; then echo "[!] Порт $PORT занят. Прерываюсь."; exit 1; fi
echo "    порт $PORT свободен; диск $(df -Pm / | awk 'NR==2{print $4}')MB; RAM $(free -m | awk '/^Mem:/{print $7}')MB (лимит контейнера 128MB)"

echo "[2/6] Самоподписанный серт (CF Full)..."
mkdir -p "$DIR"
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
  -keyout "$DIR/key.pem" -out "$DIR/cert.pem" \
  -subj "/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN}" >/dev/null 2>&1
chmod 644 "$DIR/cert.pem"; chmod 600 "$DIR/key.pem"; echo "    ok"

echo "[3/6] Конфиг..."
cat > "$DIR/config.json" <<EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": ${PORT},
      "protocol": "vless",
      "settings": { "clients": [ { "id": "${UUID}" } ], "decryption": "none" },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": { "alpn": [ "http/1.1" ], "certificates": [ { "certificateFile": "/etc/xray/cert.pem", "keyFile": "/etc/xray/key.pem" } ] },
        "wsSettings": { "path": "${WSPATH}" }
      },
      "sniffing": { "enabled": true, "destOverride": [ "http", "tls" ] }
    }
  ],
  "outbounds": [ { "protocol": "freedom", "settings": { "domainStrategy": "UseIPv4" } } ]
}
EOF
echo "    ok"

echo "[4/6] Запуск изолированного контейнера ${NAME}..."
docker rm -f "$NAME" >/dev/null 2>&1 || true
docker run -d --name "$NAME" --restart=always --network host \
  --memory=128m --memory-swap=128m \
  -v "$DIR/config.json:/etc/xray/config.json:ro" \
  -v "$DIR/cert.pem:/etc/xray/cert.pem:ro" \
  -v "$DIR/key.pem:/etc/xray/key.pem:ro" \
  "$IMG" >/dev/null
echo "    ok"

echo "[5/6] Health-check..."
sleep 3
docker ps --format '{{.Names}}' | grep -q "^${NAME}$" || { echo "[!] Контейнер не поднялся. Лог:"; docker logs "$NAME" 2>&1 | tail -25; exit 1; }
ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]" || { echo "[!] Порт $PORT не слушается. Лог:"; docker logs "$NAME" 2>&1 | tail -25; exit 1; }
echo "    работает, порт слушается"

echo "[6/6] Готово."
echo
echo "================= ССЫЛКА ДЛЯ КЛИЕНТА ================="
echo "vless://${UUID}@${DOMAIN}:${PORT}?encryption=none&security=tls&type=ws&path=${WSPATH}&host=${DOMAIN}&sni=${DOMAIN}&fp=chrome&alpn=http%2F1.1#CF-VDS"
echo
echo "Твой основной Xray (2054/2055), Hysteria, warp-svc, reality-ezpz - НЕ тронуты."
echo "======================================================="
SCRIPT
chmod +x /root/xray-cf-isolated.sh
/root/xray-cf-isolated.sh