#!/bin/bash

# Custom email checker script for Proxmox Mail Gateway
# Uses OpenRouter API to analyze emails for spam content

set -euo pipefail  # Exit on error, undefined variables, and pipe failures

# Log file configuration
LOG_FILE="/var/log/pmg-custom-check.log"
LOG_MAX_SIZE=10485760  # 10MB

# Rotate log file if it exceeds max size
rotate_log() {
    if [ -f "$LOG_FILE" ]; then
        local size=$(stat -c%s "$LOG_FILE" 2>/dev/null || echo 0)
        if [ "$size" -gt "$LOG_MAX_SIZE" ]; then
            mv "$LOG_FILE" "${LOG_FILE}.old" 2>/dev/null || true
        fi
    fi
}

# Log function to write to both STDERR (mail.log) and log file
log() {
    local message
    message="$(date '+%Y-%m-%d %H:%M:%S') - $1"
    # Explicitly write to file descriptor 2 (stderr) and handle any errors
    {
        printf '%s\n' "$message" >&2
    } 2>/dev/null || true
    rotate_log
    {
        printf '%s\n' "$message" >> "$LOG_FILE"
    } 2>/dev/null || true
}

# Function to extract email headers
extract_email_headers() {
    local email_file="$1"
    
    # Extract sender (From header) and decode base64 encoding if present
    local raw_sender=$(grep -m 1 '^From:' "$email_file" 2>/dev/null | sed 's/^From: *//' || echo "unknown")
    
    # Decode MIME encoded words (e.g., =?UTF-8?B?...?= or =?UTF-8?Q?...?=)
    local sender="$raw_sender"
    if [[ "$raw_sender" == *=?* ]]; then
        # Use Python for more reliable MIME decoding
        if command -v python3 >/dev/null 2>&1; then
            # Create temporary file approach to avoid complex quoting
            local temp_py_script="/tmp/pmg_decode_$$.py"
            cat > "$temp_py_script" << 'EOF_PY'
import sys
from email.header import decode_header
raw_sender = sys.argv[1] if len(sys.argv) > 1 else ""
decoded = decode_header(raw_sender)
result = []
for part, encoding in decoded:
    if isinstance(part, bytes):
        if encoding:
            result.append(part.decode(encoding))
        else:
            result.append(part.decode('utf-8'))
    else:
        result.append(part)
print(''.join(result))
EOF_PY
            # Ensure the Python script executes safely
            if [ -f "$temp_py_script" ]; then
                sender=$(python3 "$temp_py_script" "$raw_sender" 2>/dev/null)
                # If Python decoding failed, use original value
                if [ $? -ne 0 ] || [ -z "$sender" ]; then
                    sender="$raw_sender"
                fi
                rm -f "$temp_py_script"
            else
                # Fallback if temp script creation failed
                sender="$raw_sender"
            fi
        fi
    fi
    
    # Extract receiver (To header)
    local receiver=$(grep -m 1 '^To:' "$email_file" 2>/dev/null | sed 's/^To: *//' || echo "unknown")
    
    # Extract subject (Subject header)
    local subject=$(grep -m 1 '^Subject:' "$email_file" 2>/dev/null | sed 's/^Subject: *//' || echo "no subject")
    
    # Extract message ID (Message-ID header) - keeping for internal use only
    local message_id=$(grep -m 1 '^Message-ID:' "$email_file" 2>/dev/null | sed 's/^Message-ID: *//' || echo "no message-id")
    
    # Print the extracted headers for return
    echo "$sender|$receiver|$subject|$message_id"
}

# Print usage and exit if arguments are incorrect
if [ "$#" -ne 2 ]; then
    log "usage: $0 APIVERSION QUEUEFILENAME"
    exit 1
fi

apiver="$1"
queue_file="$2"

# Check API version
if [ "$apiver" != "v1" ]; then
    log "wrong APIVERSION: $apiver"
    exit 2
fi

# Extract email headers before processing (needed for logging in error cases)
headers_info=$(extract_email_headers "$queue_file")
sender=$(echo "$headers_info" | cut -d'|' -f1)
receiver=$(echo "$headers_info" | cut -d'|' -f2)
subject=$(echo "$headers_info" | cut -d'|' -f3)
message_id=$(echo "$headers_info" | cut -d'|' -f4)

# Whitelist/Blacklist functionality
check_whitelist_blacklist() {
    local sender="$1"
    local whitelist_file="$(dirname "$0")/whitelist.txt"
    local blacklist_file="$(dirname "$0")/blacklist.txt"
    
    # Check if sender matches whitelist
    if [ -f "$whitelist_file" ]; then
        while IFS= read -r pattern; do
            # Skip empty lines
            [ -z "$pattern" ] && continue
            if echo "$sender" | grep -qi "$pattern"; then
                log "Sender in whitelist: $sender - returning SCORE: 0"
                {
                    printf '%s\n' "SCORE: 0" >&1
                } 2>/dev/null || true
                exit 0
            fi
        done < "$whitelist_file"
    fi
    
    # Check if sender matches blacklist
    if [ -f "$blacklist_file" ]; then
        while IFS= read -r pattern; do
            # Skip empty lines
            [ -z "$pattern" ] && continue
            if echo "$sender" | grep -qi "$pattern"; then
                log "Sender in blacklist: $sender - returning SCORE: 10"
                {
                    printf '%s\n' "SCORE: 10" >&1
                } 2>/dev/null || true
                exit 0
            fi
        done < "$blacklist_file"
    fi
}

# Check whitelist/blacklist before proceeding with API check
check_whitelist_blacklist "$sender"

# Check if input file exists
if [ ! -f "$queue_file" ]; then
    log "queue file does not exist: $queue_file"
    # Output API version and result for missing file to STDOUT explicitly
    {
        printf '%s\n' "v1" >&1
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Configuration for OpenRouter API
OPENROUTER_API_KEY="sk-or-v1-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
OPENROUTER_MODEL="mistralai/mistral-small-3.1-24b-instruct"

if [ -z "$OPENROUTER_API_KEY" ]; then
    log "ERROR: OPENROUTER_API_KEY environment variable not set, cannot proceed with API check - Sender: $sender, Receiver: $receiver"
    # Output API version and result if no API key to STDOUT explicitly
    {
        printf '%s\n' "v1" >&1
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Output API version once all validation is done to STDOUT explicitly
{
    printf '%s\n' "v1" >&1
} 2>/dev/null || true

# Read the email content
email_content=""
if [ -r "$queue_file" ]; then
    email_content=$(cat "$queue_file")
    log "Successfully read email content - Sender: $sender, Receiver: $receiver, Size: $(echo -n "$email_content" | wc -c) bytes"
else
    log "ERROR: cannot read queue file: $queue_file - Sender: $sender, Receiver: $receiver"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Function to decode MIME encoded subject (similar to the one used in extract_email_headers)
decode_mime_subject() {
    local raw_subject="$1"
    local decoded_subject="$raw_subject"
    
    # Check if subject is MIME encoded (contains =?...?= pattern)
    if [[ "$raw_subject" == *=?* ]]; then
        # Use Python for reliable MIME decoding
        if command -v python3 >/dev/null 2>&1; then
            local temp_py_script="/tmp/pmg_decode_subject_$$.py"
            cat > "$temp_py_script" << 'EOF_PY'
import sys
from email.header import decode_header
raw_subject = sys.argv[1] if len(sys.argv) > 1 else ""
decoded = decode_header(raw_subject)
result = []
for part, encoding in decoded:
    if isinstance(part, bytes):
        if encoding:
            result.append(part.decode(encoding))
        else:
            result.append(part.decode('utf-8'))
    else:
        result.append(part)
print(''.join(result))
EOF_PY
            if [ -f "$temp_py_script" ]; then
                decoded_subject=$(python3 "$temp_py_script" "$raw_subject" 2>/dev/null)
                if [ $? -ne 0 ] || [ -z "$decoded_subject" ]; then
                    decoded_subject="$raw_subject"
                fi
                rm -f "$temp_py_script"
            fi
        fi
    fi
    
    echo "$decoded_subject"
}

# Decode the subject for logging
decoded_subject=$(decode_mime_subject "$subject")

# Log email details before processing with decoded subject
log "Processing email - Sender: $sender, Receiver: $receiver, Subject: $decoded_subject"

# Limit email size to prevent API errors (e.g., 100KB limit)
EMAIL_SIZE_LIMIT=52400  # 100KB in bytes (100 * 1024)
email_size=$(echo -n "$email_content" | wc -c)

if [ "$email_size" -gt "$EMAIL_SIZE_LIMIT" ]; then
    log "Email too large ($email_size bytes), truncating to $EMAIL_SIZE_LIMIT bytes - Sender: $sender, Receiver: $receiver"
    # Truncate email content, handling potential pipe issues
    email_content=$(echo "$email_content" | head -c "$EMAIL_SIZE_LIMIT" 2>/dev/null || echo "${email_content:0:$EMAIL_SIZE_LIMIT}")
fi

# Prepare the request to OpenRouter API
request_body=$(cat <<EOF
{
  "model": "$OPENROUTER_MODEL",
  "messages": [
    {
      "role": "system",
      "content": "You are an email spam classifier. Analyze the following email and determine if it is spam. Respond with a JSON object containing 'is_spam' (boolean) and 'confidence' (number between 0 and 1) and 'reason' (string explaining why). Be strict in your assessment - only mark as spam if there are clear signs of unwanted or malicious content."
    },
    {
      "role": "user",
      "content": "Please analyze this email for spam content:\n\n$email_content"
    }
  ],
  "provider": {
    "sort": "price"
  }
}
EOF
)

# Log that we're about to make the API call
log "About to call OpenRouter API - Sender: $sender, Receiver: $receiver"

# Use cURL to call the OpenRouter API
response=$(curl -s -X POST \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$request_body" \
  "https://openrouter.ai/api/v1/chat/completions" \
  --max-time 240)  # 4 minute timeout to stay under the 5-minute limit

if [ $? -ne 0 ]; then
    log "Failed to get response from OpenRouter API - Sender: $sender, Receiver: $receiver"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

if [ -z "$response" ]; then
    log "Empty response from OpenRouter API - Sender: $sender, Receiver: $receiver"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Check if jq is available before using it
if ! command -v jq >/dev/null 2>&1; then
    log "ERROR: jq command not found - Sender: $sender, Receiver: $receiver"
    printf '%s\n' "OK" >&1
    exit 0
fi

response_size=$(echo -n "$response" | wc -c)
log "Successfully received response from OpenRouter API - Sender: $sender, Receiver: $receiver, Response size: $response_size bytes"

# Check if the response contains an error, but first check if jq is available
if command -v jq >/dev/null 2>&1; then
    if echo "$response" | jq -e '.error' >/dev/null 2>&1; then
        error_message=$(echo "$response" | jq -r '.error.message // "Unknown API error"')
        error_code=$(echo "$response" | jq -r '.error.code // "Unknown code"')
        log "OpenRouter API error - Sender: $sender, Receiver: $receiver, Error: $error_message, Code: $error_code"
        printf '%s\n' "OK" >&1
        exit 0
    fi
else
    log "ERROR: jq command not found during error checking - Sender: $sender, Receiver: $receiver"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Extract the AI's response (need to extract the text content from the completion)
ai_response=$(echo "$response" | jq -r '.choices[0].message.content' 2>/dev/null)

if [ -z "$ai_response" ] || [ "$ai_response" = "null" ]; then
    log "Could not extract response from OpenRouter API - Sender: $sender, Receiver: $receiver, Response: $response"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Check if sed is available before extracting JSON
if ! command -v sed >/dev/null 2>&1; then
    log "ERROR: sed command not found - Sender: $sender, Receiver: $receiver"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Check if sed is available before extracting JSON
if ! command -v sed >/dev/null 2>&1; then
    log "ERROR: sed command not found - Sender: $sender, Receiver: $receiver"
    {
        printf '%s\n' "OK" >&1
    } 2>/dev/null || true
    exit 0
fi

# Try to extract JSON from the AI response (sometimes it's wrapped in markdown or additional text)
# Handle both markdown-wrapped JSON (```json ... ```) and plain JSON
json_response=""
if echo "$ai_response" | grep -q '```json'; then
    # Extract JSON from markdown code block
    json_response=$(echo "$ai_response" | sed -n '/```json/,/```/p' | head -n -1 | tail -n +2)
elif echo "$ai_response" | grep -E -q '\{.*\}'; then
    # Extract first JSON object found
    json_response=$(echo "$ai_response" | sed -n '/{/,/}/p' | sed -n 1p)
fi

# If extraction failed using above methods, try more flexible approach
if [ -z "$json_response" ] || [ "$json_response" = "null" ]; then
    # Find content between first { and last }
    if command -v grep >/dev/null 2>&1; then
        if echo "$ai_response" | grep -o '{.*}' >/dev/null 2>&1; then
            json_response=$(echo "$ai_response" | grep -o '{[^}]*}' | head -n 1)
        fi
    else
        log "ERROR: grep command not found during JSON extraction - Sender: $sender, Receiver: $receiver"
        {
            printf '%s\n' "OK" >&1
        } 2>/dev/null || true
        exit 0
    fi
fi

# Store the OpenRouter response for later use
openrouter_analysis="$ai_response"

# Log the complete OpenRouter analysis result
log "OpenRouter Analysis Result - Sender: $sender, Receiver: $receiver, Result: $ai_response"

# Detailed logging of the analysis results
if [ -n "$json_response" ] && [ "$json_response" != "null" ]; then
    # Check if jq is still available before parsing JSON response
    if command -v jq >/dev/null 2>&1; then
        is_spam=$(echo "$json_response" | jq -r '.is_spam' 2>/dev/null)
        confidence=$(echo "$json_response" | jq -r '.confidence' 2>/dev/null)
        reason=$(echo "$json_response" | jq -r '.reason' 2>/dev/null)
        
        log "Spam Analysis Result - Sender: $sender, Receiver: $receiver, Is Spam: $is_spam, Confidence: $confidence, Reason: $reason"
    else
        log "ERROR: jq command not found during JSON parsing - Sender: $sender, Receiver: $receiver"
        {
            printf '%s\n' "OK" >&1
        } 2>/dev/null || true
        exit 0
    fi
else
    log "Spam Analysis Result - Sender: $sender, Receiver: $receiver, Plain Text Analysis: $ai_response"
fi

if [ -n "$json_response" ] && [ "$json_response" != "null" ]; then
    # Parse the JSON response - check if jq is still available
    if command -v jq >/dev/null 2>&1; then
        is_spam=$(echo "$json_response" | jq -r '.is_spam' 2>/dev/null)
        confidence=$(echo "$json_response" | jq -r '.confidence' 2>/dev/null)
        reason=$(echo "$json_response" | jq -r '.reason' 2>/dev/null)
    else
        log "ERROR: jq command not found during JSON response parsing - Sender: $sender, Receiver: $receiver"
        printf '%s\n' "OK" >&1
        exit 0
    fi
    
    if [ "$is_spam" = "true" ]; then
        log "SPAM DETECTED - Sender: $sender, Receiver: $receiver, Confidence: $confidence, Reason: $reason, OpenRouter Analysis: $openrouter_analysis"
        
        # Calculate score from confidence
        score=$(awk "BEGIN {printf \"%.0f\", $confidence * 10}")
        
        # Extract domain from sender email address
        domain=$(echo "$sender" | grep -oE '@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | sed 's/^@//' | head -n 1)
        if [ -n "$domain" ]; then
            blacklist_file="$(dirname "$0")/blacklist.txt"
            # Check if domain is already in blacklist before adding
            if [ ! -f "$blacklist_file" ] || ! grep -Fxq "$domain" "$blacklist_file"; then
                log "Confirmed spam detected, adding domain $domain to blacklist"
                # Try to add to blacklist, but ignore errors
                {
                    echo "$domain" >> "$blacklist_file"
                } 2>/dev/null || true
            fi
        fi
        
        # Output the score result and exit immediately
        {
            printf '%s\n' "SCORE: $score" >&1
        } 2>/dev/null || true
        exit 0
    elif [ -n "$confidence" ] && [ "$confidence" != "null" ]; then
        # Check if awk is available for score calculation
        if ! command -v awk >/dev/null 2>&1; then
            log "ERROR: awk command not found - Sender: $sender, Receiver: $receiver"
            {
                printf '%s\n' "OK" >&1
            } 2>/dev/null || true
            exit 0
        fi
        
        # Convert confidence to a spam score between 0 and 10 using awk instead of bc
        score=$(awk "BEGIN {printf \"%.0f\", $confidence * 10}")
        log "Spam analysis completed - Sender: $sender, Receiver: $receiver, Confidence: $confidence, Score: $score, OpenRouter Analysis: $openrouter_analysis"

        # Only add score if it's meaningful (at least 0.3 confidence)
        if (( $(awk "BEGIN {print ($confidence > 0.3)}") )); then
            # If score is 7 or higher, add domain to blacklist
            if [ "$score" -ge 7 ]; then
                # Extract domain from sender email address
                domain=$(echo "$sender" | grep -oE '@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | sed 's/^@//' | head -n 1)
                if [ -n "$domain" ]; then
                    blacklist_file="$(dirname "$0")/blacklist.txt"
                    # Check if domain is already in blacklist before adding
                    if [ ! -f "$blacklist_file" ] || ! grep -Fxq "$domain" "$blacklist_file"; then
                        log "Score $score >= 7, adding domain $domain to blacklist"
                        # Try to add to blacklist, but ignore errors
                        {
                            echo "$domain" >> "$blacklist_file"
                        } 2>/dev/null || true
                    fi
                fi
            fi
            # Output the score result and exit immediately
            {
                printf '%s\n' "SCORE: $score" >&1
            } 2>/dev/null || true
            exit 0
        else
            # Output OK result and exit immediately
            {
                printf '%s\n' "OK" >&1
            } 2>/dev/null || true
            exit 0
        fi
    fi
else
    # If JSON parsing fails, try to infer from plain text response
    # Check if grep is available before using it
    if ! command -v grep >/dev/null 2>&1; then
        log "ERROR: grep command not found - Sender: $sender, Receiver: $receiver"
        {
            printf '%s\n' "OK" >&1
        } 2>/dev/null || true
        exit 0
    fi
    
    if echo "$ai_response" | grep -qi "spam\|phishing\|malware\|virus\|suspicious"; then
        log "SPAM DETECTED in plain text analysis - Sender: $sender, Receiver: $receiver, Analysis: $ai_response, OpenRouter Analysis: $openrouter_analysis"
        
        # Extract domain from sender email address
        domain=$(echo "$sender" | grep -oE '@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | sed 's/^@//' | head -n 1)
        if [ -n "$domain" ]; then
            blacklist_file="$(dirname "$0")/blacklist.txt"
            # Check if domain is already in blacklist before adding
            if [ ! -f "$blacklist_file" ] || ! grep -Fxq "$domain" "$blacklist_file"; then
                log "High confidence spam detected, adding domain $domain to blacklist"
                # Try to add to blacklist, but ignore errors
                {
                    echo "$domain" >> "$blacklist_file"
                } 2>/dev/null || true
            fi
        fi
        
        # Output the score result and exit immediately
        {
            printf '%s\n' "SCORE: 10" >&1
        } 2>/dev/null || true
        exit 0
    fi
fi

# Final log and result output - make sure nothing in this section fails
log "Email passed spam check - Sender: $sender, Receiver: $receiver, OpenRouter Analysis: $openrouter_analysis" 2>/dev/null || true
{
    printf '%s\n' "OK" >&1
} 2>/dev/null || true
exit 0

section: admin
    custom_check 1

sudo pmgsh get /config/ruledb/who

sudo pmgsh get /config/ruledb/who/2/objects | jq '.[] | select(.domain != null) | .domain' > /tmp/blacklist.text
sudo pmgsh get /config/ruledb/who/3/objects | jq '.[] | select(.domain != null) | .domain' > /tmp/whitelist.txt

ssh root@ip

apt update && apt upgrade -y

apt install sudo ufw nano wget fish neofetch ncdu btop fail2ban

useradd -m -G sudo -s /usr/bin/fish odin && passwd odin

ss -tulpan

nano /etc/ssh/sshd_config

ufw allow from 1.2.3.4

ufw enable

ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW IN    1.2.3.4   

ssh odin@ip

mkdir .ssh
nano .ssh/authorized_keys

ssh odin@ip

sudo grep "Failed password" /var/log/auth.log | cut -d ' ' -f 9 | sort | uniq -c | sort -rh
sudo grep "Invalid user" /var/log/auth.log | cut -d ' ' -f 9 | sort | uniq -c | sort -rh

sudo reboot

sudo dpkg-reconfigure locales

export LC_ALL=en_US.UTF-8
export LANG=en_US.UTF-8
export LANGUAGE=en_US.UTF-8

sudo nano /etc/hostname

sudo timedatectl set-timezone Europe/Moscow

docker run --rm -d -e TS_PORT=5665 -e TS_DONTKILL=1 -e TS_HTTPAUTH=1 -e TS_RDB=1 -e TS_CONF_PATH=/opt/ts/config -e TS_LOG_PATH=/opt/ts/log -e TS_TORR_DIR=/opt/ts/torrents --name torrserver -v ~/ts:/opt/ts -p 5665:5665 ghcr.io/yourok/torrserver:latest

# docker-compose.yml

version: '3.3'
services:
    torrserver:
        image: ghcr.io/yourok/torrserver
        container_name: torrserver
        environment:
            - TS_PORT=5665
            - TS_DONTKILL=1
            - TS_HTTPAUTH=0
            - TS_CONF_PATH=/opt/ts/config
            - TS_TORR_DIR=/opt/ts/torrents
        volumes:
            - './CACHE:/opt/ts/torrents'
            - './CONFIG:/opt/ts/config'
        ports:
            - '5665:5665'
        restart: unless-stopped

sudo armbian-install

sudo cp /boot/u-boot.ext /boot/u-boot-s905x-s912.bin

wget --no-verbose -O - https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

/system/device-mode/update container=yes

/interface/bridge/add name=containers

/ip/address/add address=172.17.0.1/24 interface=containers

/interface/veth/add name=veth1 address=172.17.0.2/24 gateway=172.17.0.1

/interface/bridge/port add bridge=containers interface=veth1

/container/config/set registry-url=https://registry-1.docker.io tmpdir=usb1-part1/pull

/container/mounts/add name=adguard-conf src=usb1-part1/adguard/conf dst=/opt/adguardhome/conf
/container/mounts/add name=adguard-work src=usb1-part1/adguard/work dst=/opt/adguardhome/work

/container/add remote-image=adguard/adguardhome:latest interface=veth1 root-dir=usb1-part1/adguard/root mounts=adguard-conf,adguard-work

/container/start 0

/ip firewall nat 
add action=dst-nat chain=dstnat dst-address=192.168.88.1 dst-port=3000 protocol=tcp to-addresses=172.17.0.2 to-ports=3000

/ip dns set servers=172.17.0.2

   flowchart LR
      a1[Клиент] --->|VPN|b3[IP в зоне EU/US]
          subgraph node2[Сервер]
            b3
          end
	  b3 --->C((Весь остальной мир IP))

   flowchart LR
      a1[Клиент] --->|WG|b1[IP в зоне RU]
	  b1 --->B((Российские IP))
          subgraph node2[Сервер 2]
            b3
          end
		       subgraph node1[Сервер 1]
            b1
          end
    b1 --->|WG| b3[IP в зоне EU/US]
	  b3 --->C((Весь остальной мир IP))

dig +short example.ru MX

geoiplookup mail.example.ru

pveum groupadd monitoring -comment 'Monitoring group'
pveum aclmod / -group monitoring -role PVEAuditor
pveum useradd pve_exporter@pve
pveum usermod pve_exporter@pve -group monitoring
pveum passwd pve_exporter@pve

apt update
apt install python3-pip
pip3 install prometheus-pve-exporter

mkdir -p /usr/share/pve_exporter/
cat > /usr/share/pve_exporter/pve_exporter.yml << EOF
default:
    user: pve_exporter@pve
    password: пароль_пользователя_pve_exporter
    verify_ssl: false
EOF

/usr/local/bin/pve_exporter /usr/share/pve_exporter/pve_exporter.yml

  - job_name: 'pve'
    static_configs:
      - targets:
        - 192.168.1.1:9221  # Хост 1 Proxmox VE с PVE exporter
        - 192.168.1.2:9221  # Хост 2 Proxmox VE с PVE exporter
    metrics_path: /pve
    params:
      module: [default]

   flowchart LR
      a1[nextcloud.doma.net] ---> B((Обратный прокси сервер))
      a2[speedtest.doma.net] ---> B((Обратный прокси сервер))
      a3[plex.doma.net] ---> B((Обратный прокси сервер))
      B ---> b1[192.168.88.10:8080]
      B ---> b2[192.168.88.10:9000]
      B ---> b3[192.168.88.20:3000]
          subgraph node1[Сервер 1]
            b1
            b2
          end
          subgraph node2[Сервер 2]
            b3
          end

mkdir -p nginxproxy/{data,letsencrypt}
cd nginxproxy

nano docker-compose.yml

version: '3.8'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

sudo docker compose up -d

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout domanet.key -out domanet.crt -subj "/CN=*.doma.net" \
  -addext "subjectAltName=DNS:*.doma.net" 

   flowchart LR
      a1[nextcloud.doma.net] --->|DNS|B((Обратный прокси сервер))
          subgraph node2[Сервер 2]
            b3
          end
      B ---> b3[192.168.88.20:3000]

mkdir -p prometheus/{config,snmp_exporter}
cd prometheus
wget https://raw.githubusercontent.com/andrey-dvur/Scripts/main/Prometheus-Grafana/docker-compose.yml
cd config
wget https://raw.githubusercontent.com/andrey-dvur/Scripts/main/Prometheus-Grafana/config/prometheus.yml
cd ../snmp_exporter
wget https://raw.githubusercontent.com/prometheus/snmp_exporter/snmp.yml

#########  HOMELAB ######################
  - job_name: 'node.A' # Имя узла
    static_configs:
      - targets: ['192.168.88.51:9100'] # hostname/ip-адрес узла, порт 9100 - стандартный для node-exporter
  - job_name: 'node.B'
    static_configs:
      - targets: ['192.168.88.52:9100']
  - job_name: 'node.C'
    static_configs:
      - targets: ['192.168.88.53:9100']

sudo docker compose up -d

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    ports:
    - 8080:8080
    volumes:
    - /:/rootfs:ro
    - /var/run:/var/run:rw
    - /sys:/sys:ro
    - /var/lib/docker/:/var/lib/docker:ro
    depends_on:
    - redis
  redis:
    image: redis:latest
    container_name: redis
    ports:
    - 6379:6379

  - job_name: cadvisor
    scrape_interval: 5s
    static_configs:
    - targets:
      - cadvisor:8080

sudo docker compose down

sudo docker compose up -d

  snmp_exporter:
    image: prom/snmp-exporter
    container_name: snmp_exporter
    restart: unless-stopped
    volumes:
      - ./snmp_exporter/:/etc/snmp_exporter/
    ports:
      - "9116:9116"
    depends_on:
      - prometheus

  - job_name: 'mikrotik'
    static_configs:
      - targets:
        - 192.168.88.1 # mikrotik_ip
    metrics_path: /snmp
    params:
      module: [mikrotik]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: snmp_exporter:9116

sudo docker compose down

sudo docker compose up -d