Merge pull request #25 from AppsGanin/feat/ops-hardening

Feat/ops hardening

Author: AppsGanin

README.md

@@ -85,6 +85,24 @@
   это **один проход и одна перезагрузка** конфига Xray вместо операции на каждого
 - **Дашборд**: CPU / RAM / swap / диск / сеть / VPN-трафик в реальном времени, аптайм
 
+#### 📋 Журнал действий (аудит)
+
+- Пишется **всё, что происходило с пользователем**, и кто это сделал: создание,
+  переименование, включение/отключение, смена лимитов и тарифа, сброс трафика,
+  ротация ссылки, привязка/отвязка Telegram, удаление
+- **Оплаты**: заказ создан / оплачен / отменён — с номером заказа, тарифом, суммой и способом
+- **Самообслуживание**: саморегистрация в боте, отмена подписки, оплата со страницы подписки
+- **Системные события**: истёк срок, исчерпан трафик, превышен лимит устройств,
+  автосброс квоты, перевод на бесплатный тариф после истечения
+- У каждой записи есть **автор**: админ (по логину), API-ключ (по названию),
+  Telegram-бот (по @username), сам пользователь или система (крон, вебхук провайдера)
+- Смотреть можно **по одному пользователю** — кнопка «Журнал действий» в его карточке —
+  или **сквозняком** на вкладке «Журнал», с фильтрами по типу события и по автору
+- Журнал **переживает удаление пользователя**: запись «удалён» и вся его история
+  остаются (имя сохраняется в самой записи)
+- Групповые операции пишут запись **каждому** затронутому пользователю с пометкой «массово»
+- Хранение — **90 дней**, старые записи чистятся автоматически
+
 #### 📲 Подписки
 
 - `/<путь>/<токен>` — base64-список + страница с QR и deep-links
@@ -319,6 +337,7 @@ internal/
   model/             доменные типы (User, Settings, RoutingConfig, …)
   store/             SQLite + миграции
   auth/              argon2id, секреты/токены, сессии
+  actor/             кто выполняет действие (едет в context) — для журнала аудита
   datasec/           шифрование секретов в БД (AES-GCM, ключ secrets.key)
   netguard/          SSRF-safe HTTP (валидация исходящих URL)
   tlsmgr/ tlsutil/   ACME (Let's Encrypt / ZeroSSL) + self-signed
@@ -386,6 +405,20 @@ go build -o rospanel ./cmd/rospanel
 `ROSPANEL_ADMIN_ADDR` (loopback-адрес панели, по умолчанию `127.0.0.1:8080`),
 `XRAY_BIN`, `ROSPANEL_HOST`, `ROSPANEL_ACME_EMAIL`.
 
+Защита от флуда (нафтабл-лимиты на публичных TCP-портах, см. «Эксплуатация») тоже
+настраивается через окружение — пригодится, если за одним IP сидит целый офис или
+CGNAT-оператор и клиенты упираются в дефолты:
+
+| Переменная | Что делает |
+| --- | --- |
+| `ROSPANEL_CONNLIMIT=off` | Полностью выключает лимиты (правила nftables сносятся) |
+| `ROSPANEL_CONNLIMIT_MAX` | Максимум одновременных TCP-соединений с одного IP |
+| `ROSPANEL_CONNLIMIT_RATE` | Максимум новых соединений с одного IP в секунду |
+
+Текущее состояние защиты видно в **Дашборд → Управление → Диагностика**: если
+nftables не установлен или панель работает не от root, правила молча не применятся —
+диагностика об этом скажет.
+
 PR и issue приветствуются. Коммиты — в стиле [Conventional Commits](https://www.conventionalcommits.org/):
 на их основе release-please собирает релиз и публикует бинарь + Docker-образ в GHCR.
 

cmd/rospanel/service.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/AppsGanin/rospanel/internal/auth"
+	"github.com/AppsGanin/rospanel/internal/autobackup"
 	"github.com/AppsGanin/rospanel/internal/backup"
 	"github.com/AppsGanin/rospanel/internal/connguard"
 	"github.com/AppsGanin/rospanel/internal/core"
@@ -115,7 +116,8 @@ func runServer(dataDir string) {
 	// DoS the per-user quota/device model never sees, since it happens before auth).
 	// Tunable / disable-able at runtime via ROSPANEL_CONNLIMIT* (no redeploy needed
 	// if a busy CGNAT egress trips the defaults).
-	if strings.EqualFold(env("ROSPANEL_CONNLIMIT", "on"), "off") {
+	connGuardWanted := !strings.EqualFold(env("ROSPANEL_CONNLIMIT", "on"), "off")
+	if !connGuardWanted {
 		log.Printf("connguard: disabled via ROSPANEL_CONNLIMIT=off")
 		_ = connguard.Ensure(nil, connguard.DefaultLimits()) // tear down any stale table
 	} else {
@@ -154,6 +156,8 @@ func runServer(dataDir string) {
 		filepath.Join(dataDir, "opera"))
 	sup.SetOnAccess(mgr.RecordAccess) // track online status + connection IPs
 	mgr.StartSysstat(dataDir)         // host metrics for the dashboard
+	// The health report needs to tell "off on purpose" from "on, but nft refused it".
+	mgr.SetConnGuardWanted(connGuardWanted)
 
 	// Load the proxy pool synchronously before the first reconcile so Xray starts
 	// once with the proxies already in place — instead of starting empty and being
@@ -172,6 +176,11 @@ func runServer(dataDir string) {
 	// Payment polling fallback: reconciles pending provider orders in case a webhook
 	// was missed. Idles cheaply when there are no pending orders.
 	go paymentPollLoop(mgr)
+	// Audit-log + connection-row retention: drops rows past their windows.
+	go retentionLoop(mgr)
+	// Scheduled local backups. Independent of Telegram, so an operator with no bot
+	// still gets automatic backups; idles until a cron is set in Settings.
+	go autobackup.New(mgr, st, dataDir).Run(context.Background())
 	// Telegram admin bot: view/add/remove users + scheduled backups. It idles until
 	// enabled with a token in Settings → Telegram, re-reading config each cycle.
 	go telegram.New(mgr, st, dataDir).Run(context.Background())
@@ -314,6 +323,22 @@ func paymentPollLoop(mgr *core.Manager) {
 	}
 }
 
+// retentionLoop drops audit rows and stale connection rows past their retention
+// windows. Both cutoffs move by the day, so a slow cadence is plenty — this only
+// keeps the tables from growing forever.
+func retentionLoop(mgr *core.Manager) {
+	sweep := func() {
+		mgr.PurgeOldEvents()
+		mgr.PurgeOldConnections()
+	}
+	sweep() // sweep once at boot, then on the timer
+	t := time.NewTicker(6 * time.Hour)
+	defer t.Stop()
+	for range t.C {
+		safeTick("retention sweep", sweep)
+	}
+}
+
 // tlsLoop obtains the cert if missing and renews it before expiry, reloading
 // Xray whenever the cert changes. It retries quickly while there's no usable
 // cert (e.g. ACME wasn't reachable at boot) and settles into a slow renew

docs/api.md

@@ -75,6 +75,24 @@ Base URL below is written as `$BASE` (e.g. `https://vpn.example.com/ab12cd34/v1`
 GET $BASE/health → { "data": { "status": "ok" } }
 ```
 
+#### Liveness probe (no API key)
+
+`GET $BASE/healthz` is the one endpoint that needs no key — point an uptime monitor
+or a load balancer at it. It answers **503** (not 200) when Xray isn't running: the
+panel may be fine, but the node is carrying no VPN traffic, which is what you want
+to be paged about.
+
+```
+GET $BASE/healthz
+200 → { "data": { "status": "ok",       "xray": "running", "xray_started_at": 1752230400 } }
+503 → { "data": { "status": "degraded", "xray": "down",    "xray_started_at": 0 } }
+```
+
+It lives under the API path rather than at the server root on purpose: an
+unauthenticated `/healthz` on the root would answer JSON to any scanner and give the
+panel away, defeating the decoy. The API path is stable across secret rotation, so a
+monitor pointed here keeps working.
+
 ### Users
 
 | Method | Path | Description |
@@ -137,6 +155,7 @@ required only for `extend`). Response: `{ "data": { "affected": 3 } }`.
 
 | Method | Path | Description |
 | --- | --- | --- |
+| `GET` | `/v1/billing/providers` | List the enabled payment methods (what a client can pay with). |
 | `GET` | `/v1/billing/plans?include_disabled=true` | List tariff plans. |
 | `POST` | `/v1/billing/plans` | Create (no `id`) or update (`id` set) a plan. |
 | `DELETE` | `/v1/billing/plans/{id}` | Delete a plan. |

internal/actor/actor.go

@@ -0,0 +1,50 @@
+// Package actor carries WHO is performing an action across layer boundaries.
+//
+// The audit log needs to attribute every mutation, but core.Manager sits below the
+// HTTP and bot layers and can't reach a session cookie or a Telegram update. So the
+// actor rides the request context: each entry point (panel session, API key,
+// Telegram bot, subscription page) stamps it once, and the Manager reads it back
+// when it writes its audit row.
+//
+// This lives in its own leaf package rather than in core so the bots can stamp an
+// actor without importing core — the telegram package deliberately depends on core
+// only through its own narrow Panel interface.
+package actor
+
+import (
+	"context"
+
+	"github.com/AppsGanin/rospanel/internal/model"
+)
+
+// Actor is who is performing an action: a kind (model.Actor*) and a display name.
+type Actor struct {
+	Kind string
+	Name string
+}
+
+type ctxKey struct{}
+
+// System is the fallback for anything the panel does on its own initiative — the
+// background poller, a provider webhook. A context with no actor means exactly this.
+var System = Actor{Kind: model.ActorSystem}
+
+// Admin / APIKey / Telegram / UserSelf name the four external entry points, so
+// callers don't hand-roll the kind strings.
+func Admin(username string) Actor { return Actor{Kind: model.ActorAdmin, Name: username} }
+func APIKey(name string) Actor    { return Actor{Kind: model.ActorAPIKey, Name: name} }
+func Telegram(name string) Actor  { return Actor{Kind: model.ActorTelegram, Name: name} }
+func UserSelf(name string) Actor  { return Actor{Kind: model.ActorUser, Name: name} }
+
+// With stamps the actor onto ctx for the mutating calls made under it.
+func With(ctx context.Context, a Actor) context.Context {
+	return context.WithValue(ctx, ctxKey{}, a)
+}
+
+// From returns the actor stamped on ctx, or System when none is.
+func From(ctx context.Context) Actor {
+	if a, ok := ctx.Value(ctxKey{}).(Actor); ok && a.Kind != "" {
+		return a
+	}
+	return System
+}

internal/autobackup/autobackup.go

@@ -0,0 +1,109 @@
+// Package autobackup runs scheduled local backups of the data directory.
+//
+// Scheduled backups previously existed only inside the Telegram service, so an
+// operator who never configured a bot had no automatic backups at all. This runs the
+// same schedule against local disk instead, independent of Telegram (both can be on
+// — they're separate schedules and neither knows about the other).
+package autobackup
+
+import (
+	"context"
+	"log/slog"
+	"strings"
+	"time"
+
+	"github.com/AppsGanin/rospanel/internal/backup"
+	"github.com/AppsGanin/rospanel/internal/cron"
+	"github.com/AppsGanin/rospanel/internal/store"
+)
+
+// Panel is the slice of core.Manager this needs.
+type Panel interface {
+	BackupManifest() backup.Manifest
+	Location() *time.Location // operator timezone; the cron is evaluated in it
+}
+
+type Service struct {
+	panel   Panel
+	store   *store.Store
+	dataDir string
+
+	// lastFired is the minute a backup last ran, seeded to the startup minute so a
+	// restart can't re-fire a schedule that already matched the minute we came up.
+	// Only touched from the single loop goroutine.
+	lastFired time.Time
+}
+
+func New(panel Panel, st *store.Store, dataDir string) *Service {
+	return &Service{
+		panel:     panel,
+		store:     st,
+		dataDir:   dataDir,
+		lastFired: time.Now().In(panel.Location()).Truncate(time.Minute),
+	}
+}
+
+// Run wakes every minute and lets maybeBackup decide whether the schedule is due.
+// A minute tick is the finest granularity a 5-field cron can express.
+func (s *Service) Run(ctx context.Context) {
+	t := time.NewTicker(time.Minute)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			s.maybeBackup()
+		}
+	}
+}
+
+// maybeBackup writes a backup when the operator's cron matches the current minute
+// (in the operator timezone), then prunes old archives.
+func (s *Service) maybeBackup() {
+	set, err := s.store.GetSettings()
+	if err != nil {
+		return
+	}
+	expr := strings.TrimSpace(set.LocalBackupCron)
+	if expr == "" {
+		return
+	}
+	sched, err := cron.Parse(expr)
+	if err != nil {
+		slog.Warn("autobackup: bad cron expression", "cron", expr, "err", err)
+		return
+	}
+	now := time.Now().In(s.panel.Location())
+	if !sched.Match(now) {
+		return
+	}
+	minute := now.Truncate(time.Minute)
+	if minute.Equal(s.lastFired) {
+		return
+	}
+	s.lastFired = minute
+
+	if _, err := s.RunOnce(now, set.LocalBackupKeep); err != nil {
+		slog.Error("autobackup: scheduled backup failed", "err", err)
+	}
+}
+
+// RunOnce writes one archive and rotates the directory down to keep. Exported so the
+// panel can offer a "back up now" action against the same code path the timer uses.
+func (s *Service) RunOnce(now time.Time, keep int) (string, error) {
+	path, err := backup.WriteLocal(s.dataDir, s.panel.BackupManifest(), s.store.Checkpoint, now)
+	if err != nil {
+		return "", err
+	}
+	slog.Info("autobackup: backup written", "path", path)
+
+	// A rotation failure doesn't invalidate the backup we just took, so it's logged
+	// rather than returned — the archive on disk is the thing that matters.
+	if removed, rerr := backup.Rotate(s.dataDir, keep); rerr != nil {
+		slog.Warn("autobackup: rotation failed", "err", rerr)
+	} else if removed > 0 {
+		slog.Info("autobackup: old archives removed", "count", removed, "keep", keep)
+	}
+	return path, nil
+}

internal/backup/backup.go

@@ -66,10 +66,15 @@ func WriteWithManifest(dataDir string, m Manifest, w io.Writer) error {
 		// the opera-proxy helper in opera/ — all re-fetched on demand), transient
 		// restore staging, and logs/ (operational + actively appended, which would
 		// otherwise grow mid-archive and trip "write too long").
+		//
+		// LocalBackupDir is skipped for a sharper reason: it holds previous archives,
+		// so including it would nest every backup inside the next one and blow the
+		// size up geometrically.
 		if info.IsDir() && (path == filepath.Join(dataDir, "bin") ||
 			path == filepath.Join(dataDir, "geo") ||
 			path == filepath.Join(dataDir, "opera") ||
 			path == filepath.Join(dataDir, "logs") ||
+			path == filepath.Join(dataDir, LocalBackupDir) ||
 			path == filepath.Join(dataDir, stagingDir)) {
 			return filepath.SkipDir
 		}
@@ -80,8 +85,13 @@ func WriteWithManifest(dataDir string, m Manifest, w io.Writer) error {
 		if strings.HasSuffix(path, ".db-wal") || strings.HasSuffix(path, ".db-shm") {
 			return nil
 		}
-		// Skip recovery artifacts (.bak, .bak-20060102-150405, .new).
-		if strings.HasSuffix(base, ".bak") || strings.Contains(base, ".bak-") || strings.HasSuffix(base, ".new") {
+		// Skip recovery artifacts: rospanel.db.bak, .bak-20060102-150405, .bak.20060102,
+		// config.json.new. These are copies of files already in the archive, so carrying
+		// them just bloats it — and a full DB copy is not small. Both separators matter:
+		// operators hand-roll these names, and a rule that only knew ".bak-" quietly let
+		// every ".bak.<date>" copy ride along in every backup.
+		if strings.HasSuffix(base, ".bak") || strings.Contains(base, ".bak-") ||
+			strings.Contains(base, ".bak.") || strings.HasSuffix(base, ".new") {
 			return nil
 		}
 		rel, err := filepath.Rel(dataDir, path)