gost_install.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "e04c28b5-8951-4b83-a971-994b3613cd0f",
   "metadata": {},
   "source": [
    "# 适用于为 ubuntu/debian 服务器安装 gost"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6e946c0c-e31b-4c2c-b5b3-93858a4ad8d7",
   "metadata": {},
   "source": [
    "## 1. 使用说明\n",
    "\n",
    "下面的操作都是在自己本地的电脑上完成，不需要在 VPS 上操作，这个 notebook 的功能就是把服务器上软件安装配置的过程变成了代码，会帮你在服务器上自动把软件安装好配置好。"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1e167297-bce2-4bc2-ad57-f884640de00a",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "# 如果在 colab/datalore 上需要执行下这条命令\n",
    "!pip install fabric"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "63b3285b-c0cc-4d6d-b5de-e8e29504f2b2",
   "metadata": {},
   "source": [
    "## 2. [每次都需要执行]连接服务器\n",
    "\n",
    "先执行下面代码，根据自己的情况，再从 2.1 和 2.2 中选择执行其中一个即可\n",
    "* 2.1 [2选1]使用用户名密码连接服务器\n",
    "* 2.2 [2选1]使用 SSH KEY 连接服务器"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "920a41ec-a0d5-4701-8aa6-d1f78cfb3ea0",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "from fabric import Connection\n",
    "from typing import IO\n",
    "import uuid\n",
    "\n",
    "\n",
    "# 如果用户名不是 root 需要使用 sudo，请为设置为 True\n",
    "# 如果使用 sudo，请先在服务器上安装好 sudo\n",
    "# >\n",
    "# > apt-get install -y sudo\n",
    "# >\n",
    "\n",
    "USE_SUDO = False           \n",
    "\n",
    "def run(c: Connection, cmd: str):\n",
    "    if USE_SUDO:\n",
    "        return c.sudo(cmd)\n",
    "    else:\n",
    "        return c.run(cmd)\n",
    "    \n",
    "def put(c: Connection, local_file: IO, remote_file_path: str):\n",
    "    if USE_SUDO:\n",
    "        tmp_remote_file_path = f\"/tmp/{uuid.uuid4()}\"\n",
    "        c.put(local_file, tmp_remote_file_path)\n",
    "        c.sudo(f'mv -f {tmp_remote_file_path} {remote_file_path} | true')\n",
    "    else:\n",
    "        c.put(local_file, remote_file_path)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "aa442a15-1537-41f8-8cc7-69ddef4d7c1c",
   "metadata": {},
   "source": [
    "### 2.1 [2选1]使用用户名密码连接服务器"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "41251c8c-741a-461d-b11a-9504f30eb28c",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "REMOTE_HOST = \"1.2.3.4\"    # 替换为您的远程主机名或IP地址\n",
    "REMOTE_PORT = 22           # 替换为您的远程SSH端口号\n",
    "REMOTE_USER = \"root\"       # 替换为您的远程用户名\n",
    "REMOTE_PASSWORD = \"\"       # 替换为您的远程密码\n",
    "\n",
    "conn = Connection(host=REMOTE_HOST, port=REMOTE_PORT, user=REMOTE_USER, connect_kwargs={\"password\": REMOTE_PASSWORD})"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d5c632d3-14e7-40fd-916e-07b7176fae10",
   "metadata": {},
   "source": [
    "### 2.2 [2选1]使用 SSH KEY 连接服务器"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0528435c-039b-4538-99e3-bac805b9de14",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "REMOTE_HOST = \"1.2.3.4\"       # 替换为您的远程主机名或IP地址\n",
    "REMOTE_PORT = 22              # 替换为您的远程SSH端口号\n",
    "REMOTE_USER = \"ubuntu\"          # 替换为您的远程用户名\n",
    "\n",
    "# 替换为您的私钥\n",
    "SSH_PRIVATE_KEY = \"\"\"-----BEGIN OPENSSH PRIVATE KEY-----\n",
    "...\n",
    "-----END OPENSSH PRIVATE KEY-----\n",
    "\"\"\"\n",
    "import io\n",
    "import paramiko\n",
    "\n",
    "pkey = paramiko.RSAKey.from_private_key(io.StringIO(SSH_PRIVATE_KEY))\n",
    "conn = Connection(host=REMOTE_HOST, port=REMOTE_PORT, user=REMOTE_USER, connect_kwargs={\"pkey\": pkey})"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9d069457-326d-4cd4-95a3-252b64f0ba46",
   "metadata": {},
   "source": [
    "## 3. 测试一下，确认没有任何报错，能连接上服务器，再进行下一步"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ecef5655-b253-4ef2-9b03-47113bfd61a4",
   "metadata": {},
   "outputs": [],
   "source": [
    "## 如有需要请安装 sudo\n",
    "#def install_sudo(c: Connection):\n",
    "#    c.run('apt-get install -y sudo')\n",
    "#install_sudo(conn)\n",
    "\n",
    "def test(c: Connection):\n",
    "    result = run(c, \"uname -a\")\n",
    "    print(f\"Command output: {result.stdout.strip()}\")\n",
    "        \n",
    "test(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c345230b-94f0-419b-9b7e-70e4b07f1b5e",
   "metadata": {},
   "source": [
    "## 4. 安装必要的工具"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5ac5c239-72e8-4219-b542-39f5218adbb4",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def install_tools(c: Connection):\n",
    "    run(c, 'apt-get update')\n",
    "    run(c, 'apt-get install wget -y')\n",
    "install_tools(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8abc4019-2ee3-4338-b8a4-ac880f71a6fa",
   "metadata": {},
   "source": [
    "## 5. [每次必须执行]定义 GOST 的安装位置和 WSS 端口"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "85a294d4-bbe5-45a4-9b4c-625210f4fc22",
   "metadata": {},
   "outputs": [],
   "source": [
    "# GOST 安装位置\n",
    "GOST_HOME = '/opt/gost'\n",
    "\n",
    "\n",
    "# 使用 Cloudflare 支持的 HTTPS 代理端口\n",
    "# https://developers.cloudflare.com/fundamentals/get-started/reference/network-ports/#network-ports-compatible-with-cloudflares-proxy\n",
    "# - 443\n",
    "# - 2053\n",
    "# - 2083\n",
    "# - 2087\n",
    "# - 2096\n",
    "# - 8443\n",
    "GOST_WSS_PORT=443"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "85c3c354-ea36-41bd-b71b-8de3a1608c5d",
   "metadata": {},
   "source": [
    "## 6. 下载 GOST"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8042ba42-6ca2-400e-8413-4e76417e1056",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def download_gost(c: Connection, gost_ver: str = '2.11.5'):\n",
    "    run(c, f'mkdir -p {GOST_HOME}')\n",
    "    run(c, f'rm -rf {GOST_HOME}/gost-*')\n",
    "    run(c, f'wget -nv https://github.com/ginuerzh/gost/releases/download/v{gost_ver}/gost-linux-amd64-{gost_ver}.gz -O {GOST_HOME}/gost-linux-amd64-{gost_ver}.gz | true')\n",
    "    run(c, f'gunzip {GOST_HOME}/gost-linux-amd64-{gost_ver}.gz')\n",
    "    run(c, f'mv {GOST_HOME}/gost-linux-amd64-{gost_ver} {GOST_HOME}/gost')\n",
    "    run(c, f'chmod +x {GOST_HOME}/gost')\n",
    "\n",
    "download_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e2c40853-cdde-496d-8606-87d8f6c23430",
   "metadata": {},
   "source": [
    "## 7. 设置或更新域名证书(在 Cloudflare 后台获取证书，需要登录 Cloudflare 后台创建)\n",
    "\n",
    "如果不使用 Cloudflare 的 Proxy，直连 VPS，那么这里也可以直接用默认的证书"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "20a74c69-2337-4b47-8250-b7484533ffaf",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "ca_content = \"\"\"-----BEGIN CERTIFICATE-----\n",
    "MIIDHTCCAsSgAwIBAgIUcF63xnECqLlN94qEcweJwdIyz4gwCgYIKoZIzj0EAwIw\n",
    "gY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T\n",
    "YW4gRnJhbmNpc2NvMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYDVQQL\n",
    "Ey9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhvcml0\n",
    "eTAeFw0yMzAzMTcxNTIxMDBaFw0zODAzMTMxNTIxMDBaMGIxGTAXBgNVBAoTEENs\n",
    "b3VkRmxhcmUsIEluYy4xHTAbBgNVBAsTFENsb3VkRmxhcmUgT3JpZ2luIENBMSYw\n",
    "JAYDVQQDEx1DbG91ZEZsYXJlIE9yaWdpbiBDZXJ0aWZpY2F0ZTBZMBMGByqGSM49\n",
    "AgEGCCqGSM49AwEHA0IABKAuCXtkYpEsnVk4W0zVQuWLlAYX7QIxat9IYH5pmwf8\n",
    "RZBxuSK+BrLvsRSgQaQ+Xuqv8bW/yqH81smwIxILceGjggEoMIIBJDAOBgNVHQ8B\n",
    "Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMAwGA1UdEwEB\n",
    "/wQCMAAwHQYDVR0OBBYEFESjneNGQQGg4N9DiU6TwjCuM9S2MB8GA1UdIwQYMBaA\n",
    "FIUwXTsqcNTt1ZJnB/3rObQaDjinMEQGCCsGAQUFBwEBBDgwNjA0BggrBgEFBQcw\n",
    "AYYoaHR0cDovL29jc3AuY2xvdWRmbGFyZS5jb20vb3JpZ2luX2VjY19jYTAhBgNV\n",
    "HREEGjAYggsqLmJpODMubGlua4IJYmk4My5saW5rMDwGA1UdHwQ1MDMwMaAvoC2G\n",
    "K2h0dHA6Ly9jcmwuY2xvdWRmbGFyZS5jb20vb3JpZ2luX2VjY19jYS5jcmwwCgYI\n",
    "KoZIzj0EAwIDRwAwRAIgS5M2pcS9kjrOjVlR1ImN2ieip0lgiAKMDUT7HxRfi9EC\n",
    "IGhVMiKTjlSj4u/yC+rMiDBEBvqcho9a7pvBmRdXpCRq\n",
    "-----END CERTIFICATE-----\n",
    "\"\"\"\n",
    "key_content = \"\"\"-----BEGIN PRIVATE KEY-----\n",
    "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg5bLrVhwtwJ70nwPH\n",
    "LG4Yac6+0YJilE60Gh+sLTPAXFShRANCAASgLgl7ZGKRLJ1ZOFtM1ULli5QGF+0C\n",
    "MWrfSGB+aZsH/EWQcbkivgay77EUoEGkPl7qr/G1v8qh/NbJsCMSC3Hh\n",
    "-----END PRIVATE KEY-----\n",
    "\"\"\"\n",
    "import io\n",
    "def config_cert(c: Connection):\n",
    "    ca_file_path= f\"{GOST_HOME}/ca.pem\"\n",
    "    with io.StringIO(ca_content) as ca_file:\n",
    "            put(conn, ca_file, ca_file_path)\n",
    "\n",
    "    key_file_path= f\"{GOST_HOME}/key.pem\"\n",
    "    with io.StringIO(key_content) as key_file:\n",
    "            put(conn, key_file, key_file_path)\n",
    "\n",
    "config_cert(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a74bafa6-6ed0-4d47-bb8f-5662c1dfd813",
   "metadata": {},
   "source": [
    "## 8. 设置或更新客户端用户名密码\n",
    "\n",
    "可以添加多个帐号，用户名和密码之间用空格分隔"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c10b5b9c-4384-423a-83c1-40673d21f692",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "secrets_content = \"\"\"# period for live reloading\n",
    "reload      10s\n",
    "\n",
    "# username password\n",
    "bob A5PUL_qqfkyj\n",
    "alice P9QDhs9ZVmc\n",
    "\"\"\"\n",
    "import io\n",
    "def config_secrets(c: Connection):\n",
    "    secrets_file_path= f\"{GOST_HOME}/secrets.txt\"\n",
    "    with io.StringIO(secrets_content) as secrets_file:\n",
    "            put(conn, secrets_file, secrets_file_path)\n",
    "\n",
    "config_secrets(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c3dc5597-8b7c-4509-9a7d-f7ec230426ba",
   "metadata": {},
   "source": [
    "## 9. 配置 GOST"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "04fe4712-16d3-4319-84bc-398f1e18da16",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "import json\n",
    "import io\n",
    "\n",
    "\n",
    "def config_gost(c: Connection):\n",
    "    conf_file_path = f\"{GOST_HOME}/config.json\"\n",
    "    conf = dict(ServeNodes=[\n",
    "        f\"wss://:{GOST_WSS_PORT}?secrets={GOST_HOME}/secrets.txt&cert={GOST_HOME}/ca.pem&key={GOST_HOME}/key.pem\"\n",
    "    ])\n",
    "    conf_content = json.dumps(conf, indent=4)\n",
    "    with io.StringIO(conf_content) as conf_file:\n",
    "            put(conn, conf_file, conf_file_path)\n",
    "\n",
    "            \n",
    "config_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "58c89403-495f-4b54-966b-633a5c87d827",
   "metadata": {},
   "source": [
    "## 10. 配置开机自启"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "eb000519-72d9-423f-becd-6acc5cff3705",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "gost_systemd_service_content = f\"\"\"[Unit]\n",
    "Description=Gost Service\n",
    "After=network.target\n",
    "Wants=network.target\n",
    "\n",
    "[Service]\n",
    "Type=simple\n",
    "User=root\n",
    "ExecStart={GOST_HOME}/gost -C {GOST_HOME}/config.json\n",
    "Restart=on-failure\n",
    "\n",
    "[Install]\n",
    "WantedBy=multi-user.target\n",
    "\"\"\"\n",
    "import io\n",
    "def config_systemd(c: Connection):\n",
    "    gost_systemd_service_file_path = \"/usr/lib/systemd/system/gost.service\"\n",
    "    with io.StringIO(gost_systemd_service_content) as gost_systemd_service_file:\n",
    "            put(conn, gost_systemd_service_file, gost_systemd_service_file_path)  \n",
    "    run(c, 'systemctl enable gost')\n",
    "    run(c, 'systemctl start gost')\n",
    "    \n",
    "config_systemd(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "086e7c22-de4f-4749-9fb1-db3f0119a112",
   "metadata": {},
   "source": [
    "## 11. [可选] 添加规则打开防火墙的 WSS 端口"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3c4825a6-78a9-406f-91c7-8a187f573fa2",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def iptables_allow_wss(c: Connection):\n",
    "    run(c, f'iptables -I INPUT -p tcp --dport {GOST_WSS_PORT} -j ACCEPT')\n",
    "    \n",
    "iptables_allow_wss(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6cb73ae0-d1c8-4c09-b3f5-6fb8a64626e6",
   "metadata": {},
   "source": [
    "## 12. [可选] GOST 服务操作"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cbb0b7d3-bda0-4ce3-998f-5d00794dbdae",
   "metadata": {},
   "source": [
    "## 12.1 [可选] 重启 GOST 服务"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9cde1049-f1e6-405a-861b-fa40dd489fa4",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def restart_gost(c: Connection):\n",
    "    run(c, 'systemctl restart gost')\n",
    "\n",
    "restart_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ac74f91e-25a4-4619-8ca1-11bf4ba44ef2",
   "metadata": {},
   "source": [
    "## 12.2 [可选] 停止 GOST 服务"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d5bdfbdb-54f7-4887-9409-ff32c8233f46",
   "metadata": {},
   "outputs": [],
   "source": [
    "def stop_gost(c: Connection):\n",
    "    run(c, 'systemctl stop gost')\n",
    "\n",
    "stop_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9f496d0b-87c1-4d0d-9e00-d613db2e08c6",
   "metadata": {},
   "source": [
    "## 12.3 [可选] 启动 GOST 服务"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d8f8fe47-b740-4df4-a908-a9834c41f0e1",
   "metadata": {},
   "outputs": [],
   "source": [
    "def start_gost(c: Connection):\n",
    "    run(c, 'systemctl start gost')\n",
    "\n",
    "start_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2138e7ba-0169-492c-a522-12fe88f4da5b",
   "metadata": {},
   "source": [
    "## 12.4 [可选] 查看 GOST 服务状态"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0df84dab-a11c-4c11-9cc0-2b3fca12bc4e",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def show_gost(c: Connection):\n",
    "    run(c, 'systemctl status gost')\n",
    "\n",
    "show_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ddc7ea9b-416b-44f3-8662-3aee660e7ee9",
   "metadata": {},
   "source": [
    "## 13. [可选] 开启 BBR"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "04671b61-1486-498e-99cf-2ea4beb0821f",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def enable_bbr(c: Connection):\n",
    "    prefix_sudo = 'sudo' if USE_SUDO else ''\n",
    "    run(c, f'echo -e \"net.core.default_qdisc=fq\\nnet.ipv4.tcp_congestion_control=bbr\" | {prefix_sudo} tee -a /etc/sysctl.conf >/dev/null')\n",
    "    run(c, 'sysctl -p')\n",
    "enable_bbr(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4cfb76ca-bac9-4a82-8983-327c47158893",
   "metadata": {},
   "source": [
    "## 14. [可选]安装 cloudflare-warp 解决 OpenAI 和 New Bing 无法使用的问题"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "989c754e-266e-4507-8f59-1b9719b02a67",
   "metadata": {},
   "source": [
    "### 14.1 准备安装 cloudflare-warp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2f6a8a7a-5ba5-4b0f-bca6-9b7093ba57eb",
   "metadata": {},
   "outputs": [],
   "source": [
    "def get_system_type(c: Connection):\n",
    "    uname = c.run('uname -s', hide=True).stdout.strip().lower()\n",
    "    if 'linux' in uname:\n",
    "        distro = conn.run('cat /etc/os-release | grep -w ID', hide=True).stdout.strip().lower()\n",
    "        if 'debian' in distro:\n",
    "            return 'Debian'\n",
    "        elif 'ubuntu' in distro:\n",
    "            return 'Ubuntu'\n",
    "    return 'Unknown'\n",
    "\n",
    "def prepare_for_cloudflare_warp(c: Connection):\n",
    "    run(c, 'apt-get update')\n",
    "    run(c, 'apt-get install -y gpg curl lsb-release')\n",
    "    prefix_sudo = 'sudo' if USE_SUDO else ''\n",
    "    system_type = get_system_type(c)\n",
    "    if system_type == 'Debian':\n",
    "        run(c, f'curl https://pkg.cloudflareclient.com/pubkey.gpg | {prefix_sudo} gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg')\n",
    "        run(c, f'echo \"deb [arch=amd64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main\" | {prefix_sudo} tee /etc/apt/sources.list.d/cloudflare-client.list')\n",
    "    elif system_type == 'Ubuntu':\n",
    "        run(c, f'curl https://pkg.cloudflareclient.com/pubkey.gpg | {prefix_sudo} gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg')\n",
    "        run(c, f'echo \"deb [arch=amd64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main\" | {prefix_sudo} tee /etc/apt/sources.list.d/cloudflare-client.list')\n",
    "    else:\n",
    "        print(system_type)\n",
    "        \n",
    "prepare_for_cloudflare_warp(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d20bb6cc-9770-4bd9-ba6a-bf1c3d5fb26d",
   "metadata": {},
   "source": [
    "### 14.2 安装 cloudflare-warp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "37b82b62-9bfa-4e9a-9444-ce2003437a24",
   "metadata": {},
   "outputs": [],
   "source": [
    "def install_cloudflare_warp(c: Connection):\n",
    "    run(c, 'apt-get update')\n",
    "    run(c, 'apt-get install -y cloudflare-warp')\n",
    "\n",
    "install_cloudflare_warp(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7786ee0f-8e69-40c9-b076-2a692baff0a4",
   "metadata": {},
   "source": [
    "### 14.3 配置 cloudflare-warp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6fdd0b78-a358-4e88-9b56-84e42a06f0aa",
   "metadata": {},
   "outputs": [],
   "source": [
    "def config_cloudflare_warp(c: Connection):\n",
    "    run(c, 'warp-cli --accept-tos register')\n",
    "    run(c, 'warp-cli --accept-tos set-mode proxy')\n",
    "    run(c, 'warp-cli --accept-tos connect')\n",
    "    run(c, 'warp-cli --accept-tos enable-always-on')\n",
    "    run(c, 'warp-cli --accept-tos status')\n",
    "    \n",
    "config_cloudflare_warp(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "dfd9b5c0-015c-4d8c-bf91-309fc078b00d",
   "metadata": {},
   "source": [
    "### 14.4 配置 GOST 的路由控制"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e2ab5efc-6a14-4758-b63f-eebc3ae1c725",
   "metadata": {},
   "outputs": [],
   "source": [
    "# bypass 配置说明见 https://v2.gost.run/bypass/\n",
    "# 本配置采用白名单设置，表示 google 网站会走 warp 代理\n",
    "# reverse 为 true 表示采用白名单，也就是说域名在这个配置文件中的，将会走这个代理\n",
    "# 请根据自己需要添加域名\n",
    "# sharp 符号表示注释\n",
    "# 如果不使用 bypass，请设置为 False，让所有的流量都走 warp 代理\n",
    "USE_BYPASS=True\n",
    "\n",
    "bypass_content = \"\"\"# options\n",
    "reload   10s\n",
    "reverse  true\n",
    "\n",
    "# bypass addresses\n",
    "*.google.com\n",
    "google.com\n",
    "#*.openai.com\n",
    "#openai.com\n",
    "\"\"\"\n",
    "\n",
    "import io\n",
    "def config_bypass(c: Connection):\n",
    "    bypass_file_path= f\"{GOST_HOME}/bypass.txt\"\n",
    "    with io.StringIO(bypass_content) as bypass_file:\n",
    "            put(conn, bypass_file, bypass_file_path)\n",
    "\n",
    "config_bypass(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8fe6bdcd-2539-4bf8-91b5-5574672fa636",
   "metadata": {},
   "source": [
    "### 14.5 配置 GOST 走 WAPR 代理链\n",
    "\n",
    "执行完下面这段代码之后，再去执行 12 步重启 GOST 服务"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b9f13ec7-be8a-422e-bc0a-99912124a916",
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "import io\n",
    "\n",
    "GOST_WARP_WSS_PORT=2083\n",
    "\n",
    "def config_gost_warp(c: Connection):\n",
    "    bypass_query_string = f\"?bypass={GOST_HOME}/bypass.txt\" if USE_BYPASS else \"\"\n",
    "    \n",
    "    conf_file_path = f\"{GOST_HOME}/config.json\"\n",
    "    conf = dict(\n",
    "        ServeNodes=[f\"wss://:{GOST_WSS_PORT}?secrets={GOST_HOME}/secrets.txt&cert={GOST_HOME}/ca.pem&key={GOST_HOME}/key.pem\"], \n",
    "        Routes=[dict(ServeNodes=[f\"wss://:{GOST_WARP_WSS_PORT}?secrets={GOST_HOME}/secrets.txt&cert={GOST_HOME}/ca.pem&key={GOST_HOME}/key.pem\"], \n",
    "                     ChainNodes=[f\"socks5://127.0.0.1:40000{bypass_query_string}\"])])\n",
    "    conf_content = json.dumps(conf, indent=4)\n",
    "    with io.StringIO(conf_content) as conf_file:\n",
    "            conn.put(conf_file, conf_file_path)\n",
    "\n",
    "            \n",
    "config_gost_warp(conn)\n",
    "#restart_gost(conn)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f6f4315f-2c3a-4411-9850-02917bae53e7",
   "metadata": {},
   "source": [
    "### 14.6 [可选] 添加规则打开防火墙的 WARP WSS 端口"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "aabf1b54-8a0b-493b-9d2a-29ebf08509be",
   "metadata": {},
   "outputs": [],
   "source": [
    "def iptables_allow_warp_wss(c: Connection):\n",
    "    run(c, f'iptables -I INPUT -p tcp --dport {GOST_WARP_WSS_PORT} -j ACCEPT')\n",
    "    \n",
    "iptables_allow_warp_wss(conn)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}