From b89a0abb44bbc9ff278401b67f34b770dc64ae81 Mon Sep 17 00:00:00 2001
From: grendervill <focuse@grandell.ru>
Date: Sat, 19 Sep 2026 20:23:18 +0300
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=D1=83=D1=81=D1=82=D0=B0=D0=BD?=
 =?UTF-8?q?=D0=BE=D0=B2=D1=89=D0=B8=D0=BA=20=D1=81=D0=BE=D1=85=D1=80=D0=B0?=
 =?UTF-8?q?=D0=BD=D1=8F=D0=B5=D1=82=20=D0=B8=20=D0=B2=D0=BE=D1=81=D1=81?=
 =?UTF-8?q?=D1=82=D0=B0=D0=BD=D0=B0=D0=B2=D0=BB=D0=B8=D0=B2=D0=B0=D0=B5?=
 =?UTF-8?q?=D1=82=20=D1=87=D1=83=D0=B6=D0=B8=D0=B5=20=D0=BF=D1=80=D0=B0?=
 =?UTF-8?q?=D0=B2=D0=B8=D0=BB=D0=B0=20UFW?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

На общем сервере (VPS владельца) ufw reset удалял правила WireGuard и
wstunnel. Теперь перед сбросом снимается снимок правил без комментария
glchat, а после настройки они восстанавливаются.
---
 deploy/install.sh | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/deploy/install.sh b/deploy/install.sh
index 3b1dd71..d42b624 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -831,6 +831,41 @@ install_cli_and_units() {
 
 # --- безопасность ---------------------------------------------------------
 
+UFW_FOREIGN_FILE="/tmp/glchat-ufw-foreign.rules"
+
+# snapshot_foreign_ufw_rules сохраняет правила, которые не принадлежат glchat:
+# установщик делает ufw reset, и на общем сервере (VPS) правила владельца
+# (WireGuard, wstunnel и т.п.) обязаны остаться на месте.
+snapshot_foreign_ufw_rules() {
+    : >"$UFW_FOREIGN_FILE"
+    ufw status 2>/dev/null | awk -F'# ' 'NF == 1 && /ALLOW|DENY|LIMIT|REJECT/ {print $0}' |
+        sed 's/[[:space:]]*$//' >>"$UFW_FOREIGN_FILE" || true
+}
+
+restore_foreign_ufw_rules() {
+    [ -s "$UFW_FOREIGN_FILE" ] || return 0
+    local restored=0 line to from
+    while IFS= read -r line; do
+        [ -n "$line" ] || continue
+        to="$(printf '%s' "$line" | awk '{print $1}')"
+        from="$(printf '%s' "$line" | sed -E 's/^[^ ]+[[:space:]]+(ALLOW|DENY|LIMIT|REJECT)[[:space:]]+(IN[[:space:]]+)?//')"
+        [ -n "$to" ] || continue
+        case "$to" in
+            Anywhere | anywhere) continue ;;
+        esac
+        case "$from" in
+            *" on "* | *"("* | "") from="$from" ;;
+        esac
+        if ufw allow from "$from" to any port "${to%%/*}" proto "${to##*/}" comment 'glchat:preserved' >/dev/null 2>&1; then
+            restored=$((restored + 1))
+        else
+            warn "не удалось восстановить правило UFW: ${line}"
+        fi
+    done <"$UFW_FOREIGN_FILE"
+    [ "$restored" -gt 0 ] && ok "восстановлено правил UFW владельца: ${restored}"
+    return 0
+}
+
 configure_ufw() {
     [ "$ENABLE_UFW" = "true" ] || {
         warn "UFW не настраиваем (--no-ufw)"
@@ -841,6 +876,7 @@ configure_ufw() {
         log_file_only "DRY-RUN: ufw default deny incoming; allow ${SSH_PORT}, ${LIVEKIT_TCP_PORT}/tcp, ${LIVEKIT_UDP_PORT}/udp, TURN ${TURN_UDP_PORT}/udp, ${TURN_TLS_PORT}/tcp, relay ${TURN_RELAY_START}-${TURN_RELAY_END}/udp"
         return 0
     fi
+    snapshot_foreign_ufw_rules
     ufw --force reset >/dev/null 2>&1 || true
     ufw default deny incoming >/dev/null
     ufw default allow outgoing >/dev/null
@@ -858,6 +894,7 @@ configure_ufw() {
         ufw allow "${TURN_RELAY_START}:${TURN_RELAY_END}/udp" comment 'turn-relay' >/dev/null
     fi
     ufw --force enable >/dev/null
+    restore_foreign_ufw_rules
     ok "UFW активен: $(ufw status | head -1)"
 }