---

cat > /root/add-cf-ws-inbound.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail

DOMAIN="mainnet.assaxaq.online"
PORT=8443
CFG="/usr/local/etc/xray/config.json"
CERTDIR="/usr/local/etc/xray"
BAK="$CFG.bak.$(date +%s)"
UUID="dad0fb22-a795-4e0e-b401-56972684d98b"
WSPATH="/$(head -c 24 /dev/urandom | sha256sum | cut -c1-16)"

echo "===== inbound cfws:$PORT (VLESS+WS+TLS за Cloudflare) ====="
echo "Domain : $DOMAIN"
echo "Path   : $WSPATH"
echo

echo "[1/6] python3 + бэкап..."
command -v python3 >/dev/null 2>&1 || { echo "[!] нет python3"; exit 1; }
cp "$CFG" "$BAK"; echo "    бэкап: $BAK"

echo "[2/6] Самоподписанный серт (CF Full)..."
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
  -keyout "$CERTDIR/key.pem" -out "$CERTDIR/cert.pem" \
  -subj "/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN}" >/dev/null 2>&1
chmod 600 "$CERTDIR/key.pem"; echo "    ok"

echo "[3/6] Порт $PORT свободен?"
if ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]"; then
  echo "[!] Порт $PORT занят. Откат."; cp "$BAK" "$CFG"; exit 1
fi
echo "    свободен"

echo "[4/6] Дописываю inbound cfws (python3, без перепечатки ключей)..."
export NEW_PORT="$PORT" NEW_UUID="$UUID" NEW_PATH="$WSPATH" \
       NEW_CERT="$CERTDIR/cert.pem" NEW_KEY="$CERTDIR/key.pem"
if ! python3 - "$CFG" <<'PY'
import json, sys, os
cfg_path = sys.argv[1]
with open(cfg_path) as f:
    cfg = json.load(f)
inbound = {
    "tag": "cfws",
    "listen": "0.0.0.0",
    "port": int(os.environ["NEW_PORT"]),
    "protocol": "vless",
    "settings": {"clients": [{"id": os.environ["NEW_UUID"]}], "decryption": "none"},
    "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {"alpn": ["http/1.1"],
                        "certificates": [{"certificateFile": os.environ["NEW_CERT"],
                                          "keyFile": os.environ["NEW_KEY"]}]},
        "wsSettings": {"path": os.environ["NEW_PATH"]}
    },
    "sniffing": {"enabled": True, "destOverride": ["http", "tls"]}
}
cfg["inbounds"] = [i for i in cfg.get("inbounds", []) if i.get("tag") != "cfws"]
cfg["inbounds"].append(inbound)
tmp = cfg_path + ".new"
with open(tmp, "w") as f:
    json.dump(cfg, f, indent=2)
os.replace(tmp, cfg_path)
print("    добавлено, всего inbound'ов:", len(cfg["inbounds"]))
PY
then
  echo "[!] Ошибка python. Откат."; cp "$BAK" "$CFG"; exit 1
fi

echo "[5/6] Рестарт xray..."
systemctl restart xray; sleep 3

echo "[6/6] Проверка..."
if systemctl is-active --quiet xray && ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]"; then
  echo
  echo "================= ГОТОВО ================="
  LINK="vless://${UUID}@${DOMAIN}:${PORT}?encryption=none&security=tls&type=ws&path=${WSPATH}&host=${DOMAIN}&sni=${DOMAIN}&fp=chrome&alpn=http%2F1.1#CF-VDS"
  echo "Ссылка (импорт в v2rayNG / v2rayN / Karing):"
  echo "$LINK"
  echo
  echo "Cloudflare: SSL=Full, A-запись ${DOMAIN}->109.69.57.149, оранжевое облако ВКЛ."
  echo "Существующие 2054/2055 и Hysteria продолжают работать."
  echo "=========================================="
else
  echo "[!] Xray не поднялся или порт не слушается. Лог:"
  journalctl -u xray -n 25 --no-pager
  echo "[!] Откат к бэкапу..."
  cp "$BAK" "$CFG"; systemctl restart xray
  echo "    откат выполнен, старый конфиг восстановлен."
  exit 1
fi
SCRIPT
chmod +x /root/add-cf-ws-inbound.sh
/root/add-cf-ws-inbound.sh