---

cat > /root/xray-cf-setup.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail

DOMAIN="${1:-mainnet.assaxaq.online}"
PORT=8443                       # поддерживаемый CF HTTPS-порт; свободен; не трогает 443
CONTAINER="xray-cf"
INSTDIR="/opt/xray-cf"
WSPATH="/$(head -c 24 /dev/urandom | sha256sum | cut -c1-16)"
UUID="$(cat /proc/sys/kernel/random/uuid)"
MIN_DISK_MB=200

echo "=============================================="
echo " Xray VLESS+WS+TLS за Cloudflare | exit=VDS"
echo " Domain : $DOMAIN"
echo " Port   : $PORT (CF Full -> origin TLS:$PORT)"
echo " Path   : $WSPATH"
echo " UUID   : $UUID"
echo "=============================================="

echo "[1/6] Проверки окружения..."
command -v docker >/dev/null 2>&1 || { echo "[!] Docker не найден."; exit 1; }
docker info >/dev/null 2>&1 || { echo "[!] Docker не запущен: systemctl start docker"; exit 1; }

if ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]"; then
  echo "[!] Порт $PORT занят. Прерываюсь."; exit 1
fi
echo "    порт $PORT свободен - ок"

FREE_MB=$(df -Pm / | awk 'NR==2{print $4}')
[ "$FREE_MB" -lt "$MIN_DISK_MB" ] && { echo "[!] Мало места: ${FREE_MB}MB < ${MIN_DISK_MB}MB."; exit 1; }
echo "    диск: ${FREE_MB}MB свободно - ок"
echo "    RAM доступно: $(free -m | awk '/^Mem:/{print $7}')MB (контейнер ограничен 128MB)"

echo "[2/6] Самоподписанный сертификат (CF Full не валидирует строго)..."
mkdir -p "$INSTDIR"
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
  -keyout "$INSTDIR/key.pem" -out "$INSTDIR/cert.pem" \
  -subj "/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN}" >/dev/null 2>&1
chmod 600 "$INSTDIR/key.pem"
echo "    ок"

echo "[3/6] Конфиг Xray..."
cat > "$INSTDIR/config.json" <<EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": ${PORT},
      "protocol": "vless",
      "settings": { "clients": [ { "id": "${UUID}" } ], "decryption": "none" },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "alpn": [ "http/1.1" ],
          "certificates": [ { "certificateFile": "/etc/xray/cert.pem", "keyFile": "/etc/xray/key.pem" } ]
        },
        "wsSettings": { "path": "${WSPATH}" }
      },
      "sniffing": { "enabled": true, "destOverride": [ "http", "tls" ] }
    }
  ],
  "outbounds": [ { "protocol": "freedom", "settings": { "domainStrategy": "UseIP" } } ]
}
EOF
echo "    ок"

echo "[4/6] Запуск изолированного контейнера ${CONTAINER} (RAM-лимит 128MB)..."
docker pull -q 2dust/xray:latest >/dev/null
docker rm -f "$CONTAINER" >/dev/null 2>&1 || true
docker run -d --name "$CONTAINER" \
  --restart=always --network host \
  --memory=128m --memory-swap=128m \
  --entrypoint /usr/bin/xray \
  -v "$INSTDIR/config.json:/etc/xray/config.json:ro" \
  -v "$INSTDIR/cert.pem:/etc/xray/cert.pem:ro" \
  -v "$INSTDIR/key.pem:/etc/xray/key.pem:ro" \
  2dust/xray:latest run -config /etc/xray/config.json >/dev/null
echo "    ок"

echo "[5/6] Health-check..."
sleep 3
docker ps --format '{{.Names}}' | grep -q "^${CONTAINER}$" || { echo "[!] Контейнер не поднялся. Логи:"; docker logs "$CONTAINER" 2>&1 | tail -20; exit 1; }
ss -tlnp | grep -qE "[:.]${PORT}[[:space:]]" || { echo "[!] Порт $PORT не слушается. Логи:"; docker logs "$CONTAINER" 2>&1 | tail -20; exit 1; }
echo "    контейнер работает, порт слушается - ок"

echo "[6/6] Готово."
LINK="vless://${UUID}@${DOMAIN}:${PORT}?encryption=none&security=tls&type=ws&path=${WSPATH}&host=${DOMAIN}&sni=${DOMAIN}&fp=chrome&alpn=http%2F1.1#CF-VDS"
echo
echo "================= ССЫЛКА ДЛЯ КЛИЕНТА ================="
echo "$LINK"
echo
echo "Импортируй в v2rayNG (Android) / v2rayN (Windows) / Karing."
echo "Путь: клиент -> Cloudflare -> ${DOMAIN}:${PORT} -> VDS(Нидерланды) -> интернет."
echo "Cloudflare: SSL=Full (уже стоит), A-запись ${DOMAIN} -> 109.69.57.149, оранжевое облако ВКЛ."
echo "======================================================="
SCRIPT
chmod +x /root/xray-cf-setup.sh
/root/xray-cf-setup.sh mainnet.assaxaq.online