---

cat > /root/xray-cf-v2.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
DOMAIN="mainnet.assaxaq.online"
PORT=443
NAME="xray-cf"
DIR="/opt/xray-cf"
IMG="teddysun/xray:25.12.8"
UUID="9e64c7cc-dbd7-45e7-b195-ddc6ff55dcd9"
WSPATH="/ws-d9b75d0203e559bb"

echo "[1/5] Проверки (существующее не тропаем)..."
command -v docker >/dev/null 2>&1 || { echo "[!] нет docker"; exit 1; }
docker image inspect "$IMG" >/dev/null 2>&1 || { echo "[!] образ $IMG не в локале?"; exit 1; }
if ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]"; then echo "[!] TCP $PORT занят - прерываюсь."; exit 1; fi
echo "    TCP $PORT свободен, образ локальный и готов"

echo "[2/5] Сертификат (self-signed, CF Full не валидирует)..."
mkdir -p "$DIR"
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
  -keyout "$DIR/key.pem" -out "$DIR/cert.pem" \
  -subj "/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN}" >/dev/null 2>&1
chmod 600 "$DIR/key.pem"; chmod 644 "$DIR/cert.pem";

echo "[3/5] Конфиг (VLESS+WS+TLS, без лишних ограничений alpn)..."
cat > "$DIR/config.json" <<EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": ${PORT},
      "protocol": "vless",
      "settings": { "clients": [ { "id": "${UUID}" } ], "decryption": "none" },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "certificates": [ { "certificateFile": "/etc/xray/cert.pem", "keyFile": "/etc/xray/key.pem" } ]
        },
        "wsSettings": { "path": "${WSPATH}" }
      },
      "sniffing": { "enabled": true, "destOverride": [ "http", "tls" ] }
    }
  ],
  "outbounds": [ { "protocol": "freedom", "settings": { "domainStrategy": "UseIPv4" } } ]
}
EOF

echo "[4/5] Контейнер ${NAME} (RAM-лимит 128MB, не тропает hysteria/warp/reality)..."
docker rm -f "$NAME" >/dev/null 2>&1 || true
docker run -d --name "$NAME" --restart=always --network host \
  --memory=128m --memory-swap=128m \
  -v "$DIR/config.json:/etc/xray/config.json:ro" \
  -v "$DIR/cert.pem:/etc/xray/cert.pem:ro" \
  -v "$DIR/key.pem:/etc/xray/key.pem:ro" \
  "$IMG" >/dev/null
sleep 3

echo "[5/5] Самопроверка прямо на сервере..."
CODE=$(curl -sk -o /dev/null -w '%{http_code}' -m 8 "https://127.0.0.1:${PORT}/" || true)
if [ "$CODE" != "404" ]; then
  echo "[!] Сервер не отвечает как надо (код $CODE). Логи контейнера:"
  docker logs "$NAME" 2>&1 | tail -20
  exit 1
fi
LINK="vless://${UUID}@${DOMAIN}:${PORT}?encryption=none&security=tls&type=ws&path=${WSPATH}&host=${DOMAIN}&sni=${DOMAIN}&fp=chrome#CF-VDS-443"
echo "$LINK" > /root/cf-link.txt
echo
echo "=========================== READY ==========================="
echo "Конфиг работает locally, ссылка сохранена в /root/cf-link.txt:"
echo "$LINK"
echo "Ожидай моих подтверждений через Cloudflare - потом импортируй в Hiddify."
echo "============================================================="
SCRIPT
chmod +x /root/xray-cf-v2.sh
/root/xray-cf-v2.sh