xXx

Hexid M1n1 5h3ll MobiLe

opt/cpinst/adwin_script/_[ Not.Writable ]

File://opt/cpinst/adwin_script/haproxy_block_domain.sh

#!/bin/bash

# 檢查是否有安裝 haproxy
if ! command -v haproxy &> /dev/null; then
  echo "HAProxy 尚未安裝。請先安裝。"
  exit 1
fi

# 主要設定位置
HAPROXY_HTTP_PORT=8080
HAPROXY_HTTPS_PORT=8443
HAPROXY_CONF="/etc/haproxy/haproxy.cfg"

# 取得需要阻擋網域參數，支援多個以逗號分隔
block_domains="$1"

# 取得需要 Proxy 的 IPs，支援多個以逗號分隔
proxy_ips="$2"

# 驗證網域名稱格式（只允許 a-z, 0-9, -, .，且必須有一個 .）
validate_domain() {
  [[ "$1" =~ ^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]
}

# 驗證 IPv4 格式
validate_ipv4() {
  [[ "$1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]
}

# 驗證 IPv6 格式
validate_ipv6() {
  [[ "$1" =~ ^([0-9a-fA-F:]+)$ ]]
}

# 檢查參數是否有傳入
if [ -z "$block_domains" ]; then
  echo "使用方法: $0 <domain1,domain2,...> [(可選)需要 Proxy 的 IP: proxy_ip1,proxy_ip2,...]"
  echo "範例: $0 example.com 或 $0 example.com,test.com 或 $0 example.com,test.com 1.1.1.1"
  exit 1
fi

# 如果沒有指定 proxy_ips，則預設為空
if [ -z "$proxy_ips" ]; then
  proxy_ips=()
else
  IFS=',' read -ra proxy_ip_list <<< "$proxy_ips"
  for ip in "${proxy_ip_list[@]}"; do
    ip=$(echo "$ip" | xargs)
    if [ -n "$ip" ] && ! validate_ipv4 "$ip" && ! validate_ipv6 "$ip"; then
      echo "錯誤：不合法的 IP '$ip'"
      exit 1
    fi
  done
  proxy_ips=$(echo "${proxy_ip_list[*]}" | xargs)
fi

# 檢查 block_domains
IFS=',' read -ra block_domain_list <<< "$block_domains"
for domain in "${block_domain_list[@]}"; do
  domain=$(echo "$domain" | xargs)
  if [ -n "$domain" ] && ! validate_domain "$domain"; then
    echo "錯誤：不合法的網域名稱 '$domain'"
    exit 1
  fi
done

# 取得作業系統版本
OS=$(awk -F= '/^NAME/{print $2}' /etc/os-release | sed 's/"//g')
case $OS in
    "AlmaLinux" | "Rocky Linux" | "CloudLinux" | "CentOS Linux")
        OS_VERSION=$(awk -F= '/^VERSION_ID/{print $2}' /etc/os-release | sed 's/"//g' | cut -d '.' -f 1)
        ;;
    *)
        echo "不支援的作業系統: $OS"
        exit 1
        ;;
esac

if [ "$OS_VERSION" -lt 7 ]; then
  echo "不支援的作業系統版本: $OS_VERSION"
  exit 1
fi

# 取得主要 IPv4
main_ip_v4=$(ip -4 route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1); exit}')

# 取得主要 IPv6
main_ip_v6=$(ip -6 route get 2606:4700:4700::1111 | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1); exit}')

# 取得主要共享 IPv4
main_share_ip_v4=$(whmapi1 --output=json get_shared_ip | jq -r '.data.ip')

# 取得其他獨立 IPv4
other_ips_v4=$(whmapi1 --output=json get_domain_info | jq -r --arg main_share_ip_v4 "$main_share_ip_v4" '.data.domains[] | select(.ipv4 != $main_share_ip_v4) | .ipv4' | sort -u)

# 取得其他獨立 IPv6
other_ips_v6=$(whmapi1 --output=json get_domain_info | jq -r '.data.domains[] | select(.ipv6 != null) | .ipv6' | sort -u)

# 取得其他獨立 IPv4 的 domain（只輸出 ip/servername/serveralias）
http_other_domains_v4=$(whmapi1 --output=json get_domain_info | jq -r --arg main_share_ip_v4 "$main_share_ip_v4" '.data.domains[] | select(.ipv4 != $main_share_ip_v4) | "\(.ipv4) \(.domain),"' | sort -u | xargs)

# 取得其他獨立 IPv6 的 domain（只輸出 ip/servername/serveralias）
http_other_domains_v6=$(whmapi1 --output=json get_domain_info | jq -r '.data.domains[] | select(.ipv6 != null) | "\(.ipv6) \(.domain),"' | sort -u | xargs)

# 產生 HAProxy crt list
if [ -f /tmp/haproxy_certslist.txt ]; then
  echo "正在刪除先前產生的 /tmp/haproxy_certslist.txt ..."
  rm -v -f /tmp/haproxy_certslist.txt
fi
if [ -f /tmp/haproxy_certslist.txt ]; then
  echo "無法刪除 /tmp/haproxy_certslist.txt，請檢查檔案權限是否正確。"
  exit 1
fi

# 取得 cPanel 中所有的 SSL 憑證，並產生 /tmp/haproxy_certslist.txt
whmapi1 --output=json fetch_ssl_vhosts | jq -r '.data.vhosts[].servername' | while read -r line; do
  echo "/var/cpanel/ssl/apache_tls/$line/combined" >> /tmp/haproxy_certslist.txt
done

# 處理 HAproxy 的設定檔案
## 判斷是否有現有的 haproxy 設定檔案，如果有就重新命名成 haproxy.cfg.$(timestamp)
if [ -f $HAPROXY_CONF ]; then
  mv $HAPROXY_CONF $HAPROXY_CONF.$(date +%Y%m%d%H%M%S)
fi

# 產生 HAProxy 的設定檔，依據 http_other_domains_v4 和 http_other_domains_v6 動態產生 backend
## 產生 block_domains 的 HAProxy 規則
block_http_rules=""
IFS=',' read -ra block_domain_list <<< "$block_domains"
block_http_rules="    http-request silent-drop if {"
first=1
for domain in "${block_domain_list[@]}"; do
  domain=$(echo "$domain" | xargs)
  if [ -n "$domain" ]; then
    if [ $first -eq 0 ]; then
      block_http_rules+=" or"
    fi
    # 透過 suffix match 的方式比對 host 標頭
    block_http_rules+=" hdr(host) -i -m end $domain"
    first=0
  fi
done
block_http_rules+=" }"

## 產生獨立 IPv4 的 HAProxy 規則
## 產生 frontend use_backend 規則 for http
http_use_backend_rules_v4=""
if [ -n "$http_other_domains_v4" ]; then
    while read -r line; do
        ip=$(echo $line | awk '{print $1}')
        servername=$(echo $line | awk '{print $2}')
        serveralias=$(echo $line | cut -d' ' -f3-)
        # 產生 use_backend 規則
        if [[ $ip =~ $proxy_ips ]]; then
          http_use_backend_rules_v4+="    use_backend apache_$ip if { hdr(host) -i -m end $servername"
          http_use_backend_rules_v4+=" }
"
        fi
    done <<< "$(echo "$http_other_domains_v4" | tr ',' '\n')"
fi

## 產生獨立 IPv6 的 HAProxy 規則
## 產生 frontend use_backend 規則 for http
http_use_backend_rules_v6=""
if [ -n "$http_other_domains_v6" ]; then
    while read -r line; do
        ip=$(echo $line | awk '{print $1}')
        servername=$(echo $line | awk '{print $2}')
        serveralias=$(echo $line | cut -d' ' -f3-)
        # 產生 use_backend 規則
        if [[ $ip =~ $proxy_ips ]]; then
          http_use_backend_rules_v6+="    use_backend apache_$ip if { hdr(host) -i -m end $servername"
          http_use_backend_rules_v6+=" }
"
        fi
    done <<< "$(echo "$http_other_domains_v6" | tr ',' '\n')"
fi

## 產生獨立 IPv4 的 HAProxy 規則
## 產生 frontend use_backend 規則 for https (SNI)
https_use_backend_rules_v4=""
if [ -n "$http_other_domains_v4" ]; then
    IFS=',' read -ra https_domains <<< "$http_other_domains_v4"
    for line in "${https_domains[@]}"; do
        ip=$(echo $line | awk '{print $1}')
        servername=$(echo $line | awk '{print $2}')
        if [[ $ip =~ $proxy_ips ]]; then
          https_use_backend_rules_v4+="    use_backend apache_ssl_$ip if { hdr(host) -i -m end $servername"
          https_use_backend_rules_v4+=" }
"
        fi
    done
fi

## 產生獨立 IPv6 的 HAProxy 規則
## 產生 frontend use_backend 規則 for https (SNI)
https_use_backend_rules_v6=""
if [ -n "$http_other_domains_v6" ]; then
    IFS=',' read -ra https_domains <<< "$http_other_domains_v6"
    for line in "${https_domains[@]}"; do
        ip=$(echo $line | awk '{print $1}')
        servername=$(echo $line | awk '{print $2}')
        if [[ $ip =~ $proxy_ips ]]; then
          https_use_backend_rules_v6+="    use_backend apache_ssl_$ip if { hdr(host) -i -m end $servername"
          https_use_backend_rules_v6+=" }
"
        fi
    done
fi

cat <<EOF > $HAPROXY_CONF
global
    user haproxy
    group haproxy
    daemon
    # 最大連線數
    maxconn 40000
    # 開啟 8 個 haproxy process/thread
    nbthread 8

listen stats
    bind    *:8081
    mode    http
    log     global
    maxconn 10

    # Set the required timeouts
    timeout connect         4s
    timeout client          20s
    timeout server          20s

    stats   enable
    stats   hide-version
    stats   refresh         30s
    stats   show-node
    stats   show-legends
    stats   uri             /haproxy?stats

defaults
    timeout http-keep-alive 10s
    timeout http-request 5s
    timeout connect 5s
    timeout server 10s
    timeout client 30s

frontend main_http
    bind :8080 alpn h2,http/1.1
    mode http
    option http-keep-alive
    option forwardfor

$block_http_rules
$http_use_backend_rules_v4
$http_use_backend_rules_v6
    default_backend apache_$main_share_ip_v4

$(
cat <<EOM
frontend main_https
    bind :8443 ssl crt-list /tmp/haproxy_certslist.txt strict-sni alpn h2,http/1.1
    mode http
    option http-keep-alive
    option forwardfor

$block_http_rules
$https_use_backend_rules
    default_backend apache_ssl_$main_share_ip_v4
EOM
)

# 為 main_share_ip_v4 建立 backend
backend apache_$main_share_ip_v4
    mode http
    balance roundrobin
    option http-keep-alive
    option forwardfor
    server apache $main_share_ip_v4:80 alpn h2,http/1.1

backend apache_ssl_$main_share_ip_v4
    mode http
    balance roundrobin
    option http-keep-alive
    option forwardfor
    server apache $main_share_ip_v4:443 ssl sni req.hdr(Host) verify none ca-file /etc/ssl/certs/ca-bundle.crt alpn h2,http/1.1

# 為每個 other_ips_v4 建立 backend
$(for other_ip_v4 in $other_ips_v4; do
cat <<EOB
backend apache_$other_ip_v4
    mode http
    balance roundrobin
    option http-keep-alive
    option forwardfor
    server apache_$other_ip_v4 $other_ip_v4:80 alpn h2,http/1.1

backend apache_ssl_$other_ip_v4
$(
cat <<EOM
    mode http
    balance roundrobin
    option http-keep-alive
    option forwardfor
    server apache_ssl_$other_ip_v4 $other_ip_v4:443 ssl sni req.hdr(Host) verify none ca-file /etc/ssl/certs/ca-bundle.crt alpn h2,http/1.1
EOM
)

EOB
done
)

# 為每個 other_ips_v6 建立 backend
$(for other_ip_v6 in $other_ips_v6; do
cat <<EOB
backend apache_$other_ip_v6
    mode http
    balance roundrobin
    option http-keep-alive
    option forwardfor
    server apache_$other_ip_v6 $other_ip_v6:80 alpn h2,http/1.1

backend apache_ssl_$other_ip_v6
$(cat <<EOM
    mode http
    balance roundrobin
    option http-keep-alive
    option forwardfor
    server apache_ssl_$other_ip_v6 $other_ip_v6:443 ssl sni req.hdr(Host) verify none ca-file /etc/ssl/certs/ca-bundle.crt alpn h2,http/1.1
EOM
)

EOB
done
)
EOF

# 重新啟動 HAProxy 服務
systemctl restart haproxy
sleep 1
if [ "$(systemctl is-active haproxy)" == "active" ]; then
  echo "HAProxy 設定檔案更新成功，服務已重新啟動。"
else
  echo "HAProxy 重新啟動失敗，請檢查設定檔案。"
  exit 1
fi

# 產生 iptables 防火牆規則，將封包導向到 HAProxy 的 port 8080 和 8443，且不影響本機 backend 的 80 和 443 port
## main share IP
echo "請到 Shell 輸入以下指令，將封包導向到 HAProxy 的 port 8080 和 8443，只需要輸入有受到影響的 IP 即可"
echo "另外由於 REDIRECT 的處理方式是將封包導向到 8080 和 8443 port，所以 csf 的 TCP_IN 要開啟 8080 和 8443 port"

# 由於部分網站會有類似排程自己戳自己的情況，所以本機的 main IP 就不用導向到 HAProxy
echo "iptables -t nat -A PREROUTING ! -i lo -p tcp ! -s $main_ip_v4 -d $main_share_ip_v4 --dport 80 -j REDIRECT --to-port $HAPROXY_HTTP_PORT"
echo "iptables -t nat -A PREROUTING ! -i lo -p tcp ! -s $main_ip_v4 -d $main_share_ip_v4 --dport 443 -j REDIRECT --to-port $HAPROXY_HTTPS_PORT"

## 其他獨立 IPv4
for other_ip_v4 in $other_ips_v4; do
  # 如果 other_ip_v4 有在 proxy_ips 中，才需要導向到 HAProxy
  if [[ $other_ip_v4 =~ $proxy_ips ]]; then
    echo "iptables -t nat -A PREROUTING ! -i lo -p tcp ! -s $main_ip_v4 -d $other_ip_v4 --dport 80 -j REDIRECT --to-port $HAPROXY_HTTP_PORT"
    echo "iptables -t nat -A PREROUTING ! -i lo -p tcp ! -s $main_ip_v4 -d $other_ip_v4 --dport 443 -j REDIRECT --to-port $HAPROXY_HTTPS_PORT"
  fi
done

## 其他獨立 IPv6
for other_ip_v6 in $other_ips_v6; do
  # 如果 other_ip_v6 有在 proxy_ips 中，才需要導向到 HAProxy
  if [[ $other_ip_v6 =~ $proxy_ips ]]; then
    echo "ip6tables -t nat -A PREROUTING ! -i lo -p tcp ! -s $main_ip_v6 -d $other_ip_v6 --dport 80 -j REDIRECT --to-port $HAPROXY_HTTP_PORT"
    echo "ip6tables -t nat -A PREROUTING ! -i lo -p tcp ! -s $main_ip_v6 -d $other_ip_v6 --dport 443 -j REDIRECT --to-port $HAPROXY_HTTPS_PORT"
  fi
done

Your Access Expired	Date. in : 18-09-2025
Regist : 09-12-2024	Expired : 01-12-2027