Merge pull request #44 from AppsGanin/feat/telegram-proxy-and-xray-reload

Feat/telegram proxy and xray reload

Author: AppsGanin

cmd/rospanel/service.go

@@ -14,8 +14,8 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/AppsGanin/rospanel/internal/auth"
 	"github.com/AppsGanin/rospanel/internal/abuse"
+	"github.com/AppsGanin/rospanel/internal/auth"
 	"github.com/AppsGanin/rospanel/internal/autobackup"
 	"github.com/AppsGanin/rospanel/internal/backup"
 	"github.com/AppsGanin/rospanel/internal/connguard"
@@ -228,16 +228,27 @@ func runServer(dataDir string) {
 	// Scheduled local backups. Independent of Telegram, so an operator with no bot
 	// still gets automatic backups; idles until a cron is set in Settings.
 	go autobackup.New(mgr, st, dataDir).Run(context.Background())
-	// Telegram admin bot: view/add/remove users + scheduled backups. It idles until
-	// enabled with a token in Settings → Telegram, re-reading config each cycle.
-	go telegram.New(mgr, st, dataDir).Run(context.Background())
-	// Telegram user bot: public self-service for VPN clients (registration,
-	// subscription, stats). Idles until enabled with its own token in Settings.
-	go telegram.NewUser(mgr, st).Run(context.Background())
-	// Telegram support bot: relays messages between a user's private chat and a
-	// per-user topic in the operator's forum supergroup. Idles until enabled with its
-	// own token and a group in Settings → Telegram.
-	go telegram.NewSupport(mgr, st).Run(context.Background())
+	// All three bots reach Telegram through the same egress, and in the WARP / Opera
+	// modes that egress is something this very startup brought up moments ago — Xray
+	// needs a couple of seconds past "process started" before its inbound accepts.
+	// Launched straight away they dial a refused port and then sit out their retry
+	// backoff, so the bots stay silent for ~40s after every restart. One bounded wait,
+	// shared by all three, off the startup path so the panel still serves meanwhile
+	// (it returns immediately for the direct and custom routes).
+	go func() {
+		ctx := context.Background()
+		mgr.AwaitTelegramEgress(ctx)
+		// Telegram admin bot: view/add/remove users + scheduled backups. It idles until
+		// enabled with a token in Settings → Telegram, re-reading config each cycle.
+		go telegram.New(mgr, st, dataDir).Run(ctx)
+		// Telegram user bot: public self-service for VPN clients (registration,
+		// subscription, stats). Idles until enabled with its own token in Settings.
+		go telegram.NewUser(mgr, st).Run(ctx)
+		// Telegram support bot: relays messages between a user's private chat and a
+		// per-user topic in the operator's forum supergroup. Idles until enabled with
+		// its own token and a group in Settings → Telegram.
+		go telegram.NewSupport(mgr, st).Run(ctx)
+	}()
 	// Broadcast delivery. Polls the store rather than holding a queue, so a restart
 	// mid-run resumes from the remaining recipients instead of losing or repeating.
 	go telegram.NewBroadcast(st, dataDir).Run(context.Background())
@@ -410,7 +421,7 @@ func retentionLoop(mgr *core.Manager) {
 		mgr.PurgeOldEvents()
 		mgr.PurgeOldAdminAudit()
 		mgr.PurgeOldConnections()
-		mgr.PurgeOldAbuse() // blocklist matches past their (short) window
+		mgr.PurgeOldAbuse()     // blocklist matches past their (short) window
 		mgr.PurgeOldTraffic()   // per-day traffic history past a year
 		mgr.PurgeExpiredUsers() // no-op unless the operator set a grace period
 		mgr.PurgeDeletedNodes() // reclaim node tombstones past their grace window

internal/core/manager.go

@@ -101,6 +101,7 @@ type Manager struct {
 	tgSDKBody   []byte        // cached telegram.org telegram-web-app.js (nil until first fetch)
 	tgSDKAt     time.Time     // when tgSDKBody was fetched
 	tgSDKFailAt time.Time     // when the last fetch failed; suppresses inline retries for a cooldown
+	tgSDKLogAt  time.Time     // when the last fetch failure was logged; rate-limits that line
 	tgSDKWait   chan struct{} // non-nil while a fetch is in flight; closed when it lands (singleflight)
 
 	// userNotify pushes a message to a VPN user's Telegram chat (set by the user
@@ -567,20 +568,25 @@ func (m *Manager) syncUsers() error {
 	}
 	m.setApplied(users)
 	// Xray's HandlerService can't live-apply user changes to a Hysteria2 (QUIC)
-	// inbound — its authenticator is fixed when the inbound starts. The live adu/rmu
-	// above already made the TCP lanes reflect the change instantly; only Hysteria
-	// still needs a restart to pick it up. Defer that through the normal reconcile
-	// path instead of restarting inline: the reconcile debounce coalesces a burst of
-	// user changes into a SINGLE restart, and live traffic isn't dropped on every add
-	// when nothing but Hysteria membership needs the reload. Trade-off: a removed/
-	// disabled user keeps Hysteria access until this restart (~1 debounce cycle
-	// later) — acceptable, and the TCP lanes were already revoked live.
+	// inbound: `adu` rejects it outright, and `rmu` reports success while removing
+	// nothing — so a revoked user would keep their QUIC access. The live adu/rmu above
+	// therefore skip Hysteria entirely (see xray.UserInbounds / EnabledInboundTags),
+	// and its user set is swapped by REBUILDING the inbound through the API.
 	//
-	// A CUSTOM Hysteria2 inbound counts exactly the same. Testing only the built-in
-	// lane would leave a removed user tunnelling through a custom QUIC inbound until
-	// something unrelated happened to trigger a reconcile.
-	if set.HysteriaEnabled || hasHysteria(custom) {
-		m.TriggerReconcile()
+	// That rebuild replaces what used to be a full Xray restart. A restart dropped
+	// every other lane's connections and the panel's own (:443 is Xray's; the panel
+	// sits on its fallback) for a change confined to one inbound. Only the QUIC
+	// sessions of the rebuilt lane are lost now — the users whose set just changed.
+	//
+	// A CUSTOM Hysteria2 inbound counts exactly the same, which is why the list comes
+	// from the generated config by protocol rather than from the built-in lane alone.
+	if hy := xray.HysteriaInbounds(cfg); len(hy) > 0 {
+		if err := m.sup.ReplaceInbounds(apiAddr, hy); err != nil {
+			// rmi may already have landed, so that lane could be down. A full
+			// reconcile is the one thing guaranteed to put it back.
+			logWarn("xray: rebuilding the hysteria inbounds failed; falling back to a full reload", "err", err)
+			m.TriggerReconcile()
+		}
 	}
 	return m.store.MarkConfigApplied()
 }

internal/core/manager_inbounds.go

@@ -156,6 +156,11 @@ func reservedPorts(set *model.Settings) model.ReservedPorts {
 	if set.OperaEnabled {
 		hold(set.OperaPortOr(), "Opera VPN")
 	}
+	// WARP's loopback entrance. Loopback-only, but it still occupies a port on the
+	// box, so a custom inbound must not be allowed to claim it.
+	if set.WarpEnabled && set.WarpRegistered() {
+		hold(model.PanelEgressPort, "WARP local entrance")
+	}
 	return r
 }
 
@@ -453,18 +458,6 @@ func inboundConflict(err error) error {
 	return err
 }
 
-// hasHysteria reports whether any custom inbound is Hysteria2. Such an inbound
-// cannot have its users live-updated (QUIC authenticators are fixed at start), so
-// its presence is what makes a user change need a reconcile.
-func hasHysteria(list []model.Inbound) bool {
-	for _, in := range list {
-		if in.Protocol == model.InbHysteria {
-			return true
-		}
-	}
-	return false
-}
-
 // portNetwork is the transport-layer network an inbound listens on. Hysteria2 is
 // QUIC, so it binds UDP; everything else binds TCP. Testing the wrong one would pass
 // while the real bind fails.

internal/core/manager_settings.go

@@ -630,6 +630,7 @@ const (
 	telegramSDKTTL      = 24 * time.Hour  // how long a cached copy is served before a refresh
 	telegramSDKBudget   = 5 * time.Second // cap on a single upstream fetch, inline ones included
 	telegramSDKRetryGap = time.Minute     // after a failed fetch, don't stall a page again this soon
+	telegramSDKLogGap   = time.Hour       // rate limit on the "fetch failed" log line (retries are far more frequent)
 	telegramSDKMaxBytes = 1 << 20         // the wrapper is ~120 KB; 1 MiB is ample headroom
 )
 
@@ -692,10 +693,15 @@ func (m *Manager) TelegramWebAppSDK() ([]byte, bool) {
 	return body, body != nil
 }
 
-// telegramSDKFetch performs the upstream GET. It's a var so tests can drive the
-// cache logic without a network (netguard rejects loopback, so httptest is out).
-var telegramSDKFetch = func(ctx context.Context) ([]byte, error) {
-	return netguard.Get(ctx, telegramSDKURL, telegramSDKMaxBytes)
+// telegramSDKFetch performs the upstream GET, through the operator's Telegram proxy
+// when one is set (empty = direct). It's a var so tests can drive the cache logic
+// without a network (netguard rejects loopback, so httptest is out).
+//
+// The proxy matters most precisely here. A server that cannot reach Telegram is the
+// only one that ever fails this fetch, and it is also the one whose operator has
+// configured a proxy to fix exactly that.
+var telegramSDKFetch = func(ctx context.Context, proxy string) ([]byte, error) {
+	return netguard.GetVia(ctx, telegramSDKURL, telegramSDKMaxBytes, proxy)
 }
 
 // refreshTelegramSDK refreshes a stale copy in the background (the only caller —
@@ -730,23 +736,64 @@ func (m *Manager) fetchTelegramSDK() {
 	var (
 		b   []byte
 		err error
+		// Decided inside the defer while the mutex is held, acted on by the logging
+		// switch once it is released.
+		landed, recovered, shout bool
 	)
 	defer func() {
 		m.tgSDKMu.Lock()
-		if err == nil && bytes.Contains(b, telegramSDKMarker) {
+		if landed = err == nil && bytes.Contains(b, telegramSDKMarker); landed {
+			// tgSDKLogAt non-zero means we complained about this being broken, so the
+			// operator is owed the "it works again" line.
+			recovered = !m.tgSDKLogAt.IsZero()
 			m.tgSDKBody, m.tgSDKAt = b, time.Now()
-			m.tgSDKFailAt = time.Time{}
+			m.tgSDKFailAt, m.tgSDKLogAt = time.Time{}, time.Time{}
 		} else {
 			m.tgSDKFailAt = time.Now()
+			// Log the reason, but not on every attempt: a blocked telegram.org fails
+			// once per telegramSDKRetryGap for as long as the page sees traffic, and
+			// that would push everything else out of the 1000-line dashboard ring
+			// inside a day. One line per telegramSDKLogGap is enough to diagnose it.
+			if shout = time.Since(m.tgSDKLogAt) >= telegramSDKLogGap; shout {
+				m.tgSDKLogAt = time.Now()
+			}
 		}
 		if m.tgSDKWait != nil {
 			close(m.tgSDKWait) // wake the riders; they re-read the cache
 			m.tgSDKWait = nil
 		}
 		m.tgSDKMu.Unlock()
+
+		// Logging happens after the unlock: a slog handler can write to disk, and the
+		// riders released just above are waiting to take this same mutex.
+		//
+		// The two failure branches cost the operator the same thing — /tg.js goes out
+		// empty, so window.Telegram never appears and the "open in app" buttons stop
+		// working inside the Telegram Mini App — so both spell that out. They differ
+		// only in cause, which is exactly what the operator can't see from outside.
+		switch {
+		case landed:
+			if recovered {
+				logInfo("telegram mini app sdk reachable again", "bytes", len(b))
+			}
+		case !shout: // same failure already reported inside the log gap
+		case err != nil:
+			logWarn("telegram mini app sdk fetch failed; /tg.js will be served empty and in-app deep links will not work",
+				"url", telegramSDKURL, "err", err)
+		default:
+			logWarn("telegram mini app sdk fetch returned an unexpected body (blocked or truncated); /tg.js will be served empty and in-app deep links will not work",
+				"url", telegramSDKURL, "bytes", len(b))
+		}
 	}()
 
 	ctx, cancel := context.WithTimeout(context.Background(), telegramSDKBudget)
 	defer cancel()
-	b, err = telegramSDKFetch(ctx)
+	// Read fresh rather than caching the proxy on the Manager: this runs at most once
+	// per cooldown, so one settings read is nothing, and it means a just-saved proxy
+	// takes effect on the next page load instead of after a restart.
+	var proxy string
+	if set, serr := m.store.GetSettings(); serr == nil {
+		proxy = set.TelegramProxyURL()
+	}
+	b, err = telegramSDKFetch(ctx, proxy)
 }