ridzimeko / warp-ipv6

#!/usr/bin/env bash set -Eeuo pipefail IFS=$'\n\t' export LC_ALL=C readonly SCRIPT_NAME="${0##*/}" readonly SCRIPT_VERSION="2.0.1" readonly BOOTSTRAP_SERVICE="warp-ipv4-bootstrap.service" readonly BOOTSTRAP_UNIT="/etc/systemd/system/${BOOTSTRAP_SERVICE}" readonly BOOTSTRAP_HELPER="/usr/local/libexec/warp-ipv4-bootstrap" readonly WARP_DROPIN_DIR="/etc/systemd/system/warp-svc.service.d" readonly WARP_DROPIN_FILE="${WARP_DROPIN_DIR}/20-ipv4-bootstrap.conf" readonly LEGACY_DROPIN_FILE="${WARP_DROPIN_DIR}/override.conf" readonly STATE_DIR="/var/lib/warp-ipv4-egress" readonly STATE_FILE="${STATE_DIR}/state.env" readonly BACKUP_DIR="/root/warp-ipv4-egress-backups" readonly ROLLBACK_SCRIPT="/root/warp-ipv4-egress-rollback.sh" readonly ROLLBACK_UNIT="warp-ipv4-egress-rollback-${$}" readonly LEGACY_ROLLBACK_UNIT="warp-ipv4-egress-rollback" readonly LOCK_FILE="/run/lock/warp-ipv4-egress-install.lock" DUMMY_IPV4="${DUMMY_IPV4:-192.168.254.2}" DUMMY_PREFIX="${DUMMY_PREFIX:-32}" DUMMY_GATEWAY="${DUMMY_GATEWAY:-192.168.254.1}" DUMMY_METRIC="${DUMMY_METRIC:-65000}" FRESH_INSTALL="${FRESH_INSTALL:-1}" ALLOW_IPV4_SSH="${ALLOW_IPV4_SSH:-0}" CHECK_ONLY=0 IFACE="${IFACE:-}" VERSION_CODENAME="" PRETTY_NAME="" ARCH="" IP_BIN="" OLD_IFACE="" OLD_DUMMY_IPV4="" OLD_DUMMY_PREFIX="" OLD_DUMMY_GATEWAY="" OLD_DUMMY_METRIC="" TMP_DIR="" BACKUP_FILE="" DIAG_FILE="" TEMP_TUN="" ROLLBACK_ARMED=0 WARP_MASKED_BY_SCRIPT=0 WARP_ACCEPT_TOS=0 INSTALL_SUCCESS=0 LOCK_FD=9 APT_OPTS=( -o Acquire::ForceIPv6=true -o Acquire::Retries=3 -o Dpkg::Use-Pty=0 ) usage() { cat <<EOF_USAGE ${SCRIPT_NAME} ${SCRIPT_VERSION} Cloudflare WARP IPv4 egress untuk VPS Ubuntu IPv6-only. Opsi: --check-only Jalankan pemeriksaan host tanpa instalasi/pembersihan. --fresh Paksa instalasi fresh (default). --no-fresh Pertahankan registrasi/state WARP yang sudah ada. -h, --help Tampilkan bantuan. Environment override: IFACE, DUMMY_IPV4, DUMMY_PREFIX, DUMMY_GATEWAY, DUMMY_METRIC, FRESH_INSTALL=0|1, ALLOW_IPV4_SSH=0|1 EOF_USAGE } log() { printf '\n\033[1;34m[%s]\033[0m %s\n' "$(date '+%H:%M:%S')" "$*" } ok() { printf '\033[1;32m[OK]\033[0m %s\n' "$*" } warn() { printf '\033[1;33m[WARN]\033[0m %s\n' "$*" >&2 } collect_diagnostics() { local reason="${1:-unknown error}" [[ ${EUID:-1} -eq 0 ]] || return 0 if ! command -v systemctl >/dev/null 2>&1 \ && ! command -v warp-cli >/dev/null 2>&1; then return 0 fi DIAG_FILE="/root/warp-ipv4-egress-diagnostics-$(date '+%Y%m%d-%H%M%S').log" { printf 'Reason: %s\n' "$reason" printf 'Date: %s\n' "$(date -Is 2>/dev/null || date)" printf 'Script: %s %s\n' "$SCRIPT_NAME" "$SCRIPT_VERSION" printf 'Interface: %s\n' "${IFACE:-unknown}" printf '\n===== OS =====\n' cat /etc/os-release 2>/dev/null || true uname -a 2>/dev/null || true printf '\n===== IPv4 addresses/routes =====\n' ip -4 addr show 2>/dev/null || true ip -4 route show table all 2>/dev/null || true printf '\n===== IPv6 addresses/routes =====\n' ip -6 addr show 2>/dev/null || true ip -6 route show table all 2>/dev/null || true printf '\n===== warp-cli version/status =====\n' warp-cli --version 2>&1 || true timeout 10 warp-cli --accept-tos status 2>&1 \ || timeout 10 warp-cli status 2>&1 \ || true printf '\n===== warp-svc status =====\n' systemctl status warp-svc.service --no-pager 2>&1 || true printf '\n===== bootstrap status =====\n' systemctl status "$BOOTSTRAP_SERVICE" --no-pager 2>&1 || true printf '\n===== warp-svc journal =====\n' journalctl -u warp-svc.service -n 180 --no-pager 2>&1 || true } >"$DIAG_FILE" 2>&1 || true chmod 0600 "$DIAG_FILE" 2>/dev/null || true warn "Diagnostik disimpan di ${DIAG_FILE}" } fatal() { local message="$*" printf '\033[1;31m[ERROR]\033[0m %s\n' "$message" >&2 collect_diagnostics "$message" || true exit 1 } on_error() { local exit_code=$? local line_no="${BASH_LINENO[0]:-unknown}" local failed_command="${BASH_COMMAND:-unknown}" [[ $- == *e* ]] || return 0 trap - ERR set +e printf '\033[1;31m[ERROR]\033[0m Kegagalan tak terduga (exit %s) di baris %s.\n' \ "$exit_code" "$line_no" >&2 printf ' Perintah: %s\n' "$failed_command" >&2 collect_diagnostics "unexpected exit ${exit_code} at line ${line_no}: ${failed_command}" || true return 0 } on_exit() { local exit_code=$? trap - EXIT INT TERM HUP set +e if [[ -n "$TEMP_TUN" ]]; then ip link delete "$TEMP_TUN" >/dev/null 2>&1 || true fi if (( exit_code != 0 && ROLLBACK_ARMED == 1 )); then warn "Instalasi tidak selesai. Menjalankan rollback untuk memulihkan jalur IPv6/SSH." systemctl stop "${ROLLBACK_UNIT}.timer" "${ROLLBACK_UNIT}.service" >/dev/null 2>&1 || true bash "$ROLLBACK_SCRIPT" >/dev/null 2>&1 || true fi if (( WARP_MASKED_BY_SCRIPT == 1 )); then systemctl unmask --runtime warp-svc.service >/dev/null 2>&1 || true WARP_MASKED_BY_SCRIPT=0 fi if [[ -n "$TMP_DIR" && -d "$TMP_DIR" ]]; then rm -rf "$TMP_DIR" fi exit "$exit_code" } trap on_error ERR trap on_exit EXIT trap 'exit 130' INT trap 'exit 143' TERM HUP parse_args() { while (($#)); do case "$1" in --check-only) CHECK_ONLY=1 ;; --fresh) FRESH_INSTALL=1 ;; --no-fresh) FRESH_INSTALL=0 ;; -h|--help) usage exit 0 ;; *) printf 'Opsi tidak dikenal: %s\n\n' "$1" >&2 usage >&2 exit 2 ;; esac shift done } require_root() { [[ ${EUID} -eq 0 ]] || fatal "Jalankan script ini sebagai root." } validate_boolean() { [[ "$1" == "0" || "$1" == "1" ]] } validate_ipv4() { local value="$1" local IFS=. local -a octets local octet read -r -a octets <<<"$value" [[ ${#octets[@]} -eq 4 ]] || return 1 for octet in "${octets[@]}"; do [[ "$octet" =~ ^[0-9]+$ ]] || return 1 ((10#$octet >= 0 && 10#$octet <= 255)) || return 1 done } validate_iface() { [[ "$1" =~ ^[a-zA-Z0-9_.:-]+$ ]] } check_inputs() { validate_boolean "$FRESH_INSTALL" || fatal "FRESH_INSTALL harus 0 atau 1." validate_boolean "$ALLOW_IPV4_SSH" || fatal "ALLOW_IPV4_SSH harus 0 atau 1." validate_ipv4 "$DUMMY_IPV4" || fatal "DUMMY_IPV4 tidak valid: $DUMMY_IPV4" validate_ipv4 "$DUMMY_GATEWAY" || fatal "DUMMY_GATEWAY tidak valid: $DUMMY_GATEWAY" [[ "$DUMMY_PREFIX" =~ ^[0-9]+$ ]] \ && ((DUMMY_PREFIX >= 0 && DUMMY_PREFIX <= 32)) \ || fatal "DUMMY_PREFIX harus 0-32." [[ "$DUMMY_METRIC" =~ ^[0-9]+$ ]] \ && ((DUMMY_METRIC >= 1 && DUMMY_METRIC <= 4294967295)) \ || fatal "DUMMY_METRIC tidak valid." } check_platform() { [[ -r /etc/os-release ]] || fatal "/etc/os-release tidak ditemukan." source /etc/os-release [[ "${ID:-}" == "ubuntu" ]] \ || fatal "Script ini khusus Ubuntu. Terdeteksi: ${PRETTY_NAME:-unknown}" case "${VERSION_CODENAME:-}" in jammy|noble|resolute) ;; *) fatal "Ubuntu ${VERSION_CODENAME:-unknown} tidak didukung oleh repository WARP resmi. Target: jammy/noble/resolute." ;; esac ARCH="$(dpkg --print-architecture 2>/dev/null || true)" [[ -n "$ARCH" ]] || fatal "Arsitektur dpkg tidak dapat dideteksi." ok "OS: ${PRETTY_NAME} (${VERSION_CODENAME}), arsitektur ${ARCH}" } check_systemd() { [[ -d /run/systemd/system ]] \ || fatal "systemd tidak aktif sebagai init system. Script ini membutuhkan systemd." command -v systemctl >/dev/null 2>&1 || fatal "systemctl tidak ditemukan." command -v systemd-run >/dev/null 2>&1 || fatal "systemd-run tidak ditemukan." local state state="$(systemctl is-system-running 2>/dev/null || true)" case "$state" in running|degraded|starting) ;; *) fatal "Status systemd tidak siap: ${state:-unknown}" ;; esac ok "systemd siap (${state})." } acquire_lock() { install -d -m 0755 /run/lock exec 9>"$LOCK_FILE" flock -n "$LOCK_FD" \ || fatal "Ada proses instalasi WARP IPv4 lain yang sedang berjalan." } bootstrap_dependencies() { local -a required=(apt-get apt-cache dpkg dpkg-query systemctl systemd-run flock) local cmd for cmd in "${required[@]}"; do command -v "$cmd" >/dev/null 2>&1 || fatal "Perintah wajib tidak ditemukan: $cmd" done if (( CHECK_ONLY == 1 )); then local -a check_commands=(ip curl gpg getent timeout awk grep sed find tar df install) local -a missing=() for cmd in "${check_commands[@]}"; do command -v "$cmd" >/dev/null 2>&1 || missing+=("$cmd") done ((${#missing[@]} == 0)) \ || fatal "Mode --check-only tidak memasang paket. Perintah yang belum ada: ${missing[*]}" return 0 fi log "Tahap 1/6: memastikan dependensi dasar tersedia melalui IPv6" export DEBIAN_FRONTEND=noninteractive apt-get "${APT_OPTS[@]}" update apt-get "${APT_OPTS[@]}" install -y --no-install-recommends \ ca-certificates curl gnupg lsb-release iproute2 util-linux for cmd in ip curl gpg getent timeout awk grep sed find tar df install; do command -v "$cmd" >/dev/null 2>&1 || fatal "Dependensi terpasang tetapi perintah tidak ditemukan: $cmd" done IP_BIN="$(command -v ip)" ok "Dependensi dasar siap." } detect_interface() { if [[ -n "$IFACE" ]]; then validate_iface "$IFACE" || fatal "Nama interface tidak valid: $IFACE" ip link show dev "$IFACE" >/dev/null 2>&1 \ || fatal "Interface $IFACE tidak ditemukan." return 0 fi IFACE="$( ip -6 route show default 2>/dev/null \ | awk '!found {for (i=1; i<=NF; i++) if ($i=="dev") {d=$(i+1); if (d !~ /^(lo|CloudflareWARP|warp|wg|tun)/) {print d; found=1; break}}}' )" if [[ -z "$IFACE" ]]; then IFACE="$( ip -6 route get 2606:4700:4700::1111 2>/dev/null \ | awk '!found {for (i=1; i<=NF; i++) if ($i=="dev") {print $(i+1); found=1; break}}' )" fi if [[ -z "$IFACE" ]]; then IFACE="$( ip -6 -o addr show scope global 2>/dev/null \ | awk '!found && $2 !~ /^(lo|CloudflareWARP|warp|wg|tun)/ {print $2; found=1}' )" fi [[ -n "$IFACE" ]] \ || fatal "Interface IPv6 utama tidak dapat dideteksi. Gunakan IFACE=eth0." validate_iface "$IFACE" || fatal "Nama interface hasil deteksi tidak valid: $IFACE" ip link show dev "$IFACE" >/dev/null 2>&1 \ || fatal "Interface hasil deteksi tidak ada: $IFACE" } read_state_value() { local key="$1" local file="$2" awk -F= -v wanted="$key" ' $1 == wanted && !found { value = substr($0, index($0, "=") + 1) if (value !~ /[[:space:]]/) { print value found = 1 } } ' "$file" 2>/dev/null } read_old_managed_state() { local unit_line if [[ -r "$STATE_FILE" ]]; then OLD_IFACE="$(read_state_value IFACE "$STATE_FILE")" OLD_DUMMY_IPV4="$(read_state_value DUMMY_IPV4 "$STATE_FILE")" OLD_DUMMY_PREFIX="$(read_state_value DUMMY_PREFIX "$STATE_FILE")" OLD_DUMMY_GATEWAY="$(read_state_value DUMMY_GATEWAY "$STATE_FILE")" OLD_DUMMY_METRIC="$(read_state_value DUMMY_METRIC "$STATE_FILE")" fi if [[ -r "$BOOTSTRAP_UNIT" ]]; then while IFS= read -r unit_line; do if [[ -z "$OLD_DUMMY_IPV4" \ && "$unit_line" =~ ^ExecStart=.*[/]ip[[:space:]]+-4[[:space:]]+addr[[:space:]]+replace[[:space:]]+([0-9.]+)/([0-9]+)[[:space:]]+dev[[:space:]]+([a-zA-Z0-9_.:-]+)$ ]]; then OLD_DUMMY_IPV4="${BASH_REMATCH[1]}" OLD_DUMMY_PREFIX="${BASH_REMATCH[2]}" OLD_IFACE="${BASH_REMATCH[3]}" fi if [[ -z "$OLD_DUMMY_GATEWAY" \ && "$unit_line" =~ ^ExecStart=.*[/]ip[[:space:]]+-4[[:space:]]+route[[:space:]]+replace[[:space:]]+default[[:space:]]+via[[:space:]]+([0-9.]+)[[:space:]]+dev[[:space:]]+([a-zA-Z0-9_.:-]+).*metric[[:space:]]+([0-9]+)$ ]]; then OLD_DUMMY_GATEWAY="${BASH_REMATCH[1]}" [[ -n "$OLD_IFACE" ]] || OLD_IFACE="${BASH_REMATCH[2]}" OLD_DUMMY_METRIC="${BASH_REMATCH[3]}" fi done <"$BOOTSTRAP_UNIT" fi if [[ -n "$OLD_IFACE" ]] && ! validate_iface "$OLD_IFACE"; then OLD_IFACE="" fi if [[ -n "$OLD_DUMMY_IPV4" ]] && ! validate_ipv4 "$OLD_DUMMY_IPV4"; then OLD_DUMMY_IPV4="" fi if [[ -n "$OLD_DUMMY_GATEWAY" ]] && ! validate_ipv4 "$OLD_DUMMY_GATEWAY"; then OLD_DUMMY_GATEWAY="" fi if [[ -n "$OLD_DUMMY_PREFIX" && ! "$OLD_DUMMY_PREFIX" =~ ^[0-9]+$ ]]; then OLD_DUMMY_PREFIX="" fi if [[ -n "$OLD_DUMMY_METRIC" && ! "$OLD_DUMMY_METRIC" =~ ^[0-9]+$ ]]; then OLD_DUMMY_METRIC="" fi } is_managed_ipv4_address() { local iface="$1" local cidr="$2" [[ "$iface" == "$IFACE" && "$cidr" == "${DUMMY_IPV4}/${DUMMY_PREFIX}" ]] \ && return 0 [[ -n "$OLD_IFACE" && -n "$OLD_DUMMY_IPV4" && -n "$OLD_DUMMY_PREFIX" \ && "$iface" == "$OLD_IFACE" \ && "$cidr" == "${OLD_DUMMY_IPV4}/${OLD_DUMMY_PREFIX}" ]] \ && return 0 [[ "$iface" =~ ^CloudflareWARP ]] && return 0 return 1 } is_managed_default_route() { local route="$1" [[ "$route" == *"via ${DUMMY_GATEWAY} dev ${IFACE}"* ]] && return 0 [[ -n "$OLD_DUMMY_GATEWAY" && -n "$OLD_IFACE" \ && "$route" == *"via ${OLD_DUMMY_GATEWAY} dev ${OLD_IFACE}"* ]] \ && return 0 [[ "$route" =~ dev[[:space:]]+CloudflareWARP ]] && return 0 return 1 } check_ipv6_only_target() { local iface cidr route local found_unmanaged=0 while IFS=' ' read -r iface cidr; do [[ -n "$iface" && -n "$cidr" ]] || continue if ! is_managed_ipv4_address "$iface" "$cidr"; then warn "IPv4 global tidak dikelola script: ${cidr} pada ${iface}" found_unmanaged=1 fi done < <(ip -4 -o addr show scope global 2>/dev/null | awk '{print $2, $4}') while IFS= read -r route; do [[ -n "$route" ]] || continue if ! is_managed_default_route "$route"; then warn "Default route IPv4 tidak dikelola script: ${route}" found_unmanaged=1 fi done < <(ip -4 route show default 2>/dev/null) ((found_unmanaged == 0)) \ || fatal "Host memiliki IPv4 asli/route IPv4 lain. Script ini hanya untuk VPS IPv6-only." ok "Tidak ditemukan IPv4 native yang akan bentrok." } check_ssh_safety() { local client_ip="" client_port="" server_ip="" server_port="" if [[ -n "${SSH_CONNECTION:-}" ]]; then IFS=' ' read -r client_ip client_port server_ip server_port <<<"$SSH_CONNECTION" if [[ "$server_ip" == *:* ]]; then ok "Sesi SSH terdeteksi melalui IPv6 (${server_ip})." elif (( ALLOW_IPV4_SSH == 1 )); then warn "Sesi SSH terlihat memakai IPv4 (${server_ip}); ALLOW_IPV4_SSH=1 aktif." else fatal "Sesi SSH terlihat memakai IPv4 (${server_ip}). Gunakan console/noVNC atau set ALLOW_IPV4_SSH=1 dengan risiko putus koneksi." fi else warn "SSH_CONNECTION tidak tersedia. Pastikan console/noVNC tetap terbuka selama instalasi." fi } check_ipv6_host_state() { local route6 global_v6 disable_all disable_iface free_kb global_v6="$( ip -6 -o addr show dev "$IFACE" scope global 2>/dev/null \ | awk '!found {print $4; found=1}' )" [[ -n "$global_v6" ]] \ || fatal "Interface ${IFACE} tidak memiliki IPv6 global." route6="$(ip -6 route get 2606:4700:4700::1111 2>/dev/null || true)" [[ -n "$route6" ]] || fatal "Tidak ada route IPv6 ke Internet." grep -Eq "dev[[:space:]]+${IFACE}([[:space:]]|$)" <<<"$route6" \ || fatal "Route IPv6 utama tidak melalui ${IFACE}: ${route6}" ip -6 route get 2606:4700:102::3 >/dev/null 2>&1 \ || fatal "Tidak ada route IPv6 ke endpoint WARP 2606:4700:102::3." disable_all="$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null || echo 1)" disable_iface="$(cat "/proc/sys/net/ipv6/conf/${IFACE}/disable_ipv6" 2>/dev/null || echo 1)" [[ "$disable_all" == "0" && "$disable_iface" == "0" ]] \ || fatal "IPv6 dinonaktifkan melalui sysctl pada host/interface." free_kb="$(df -Pk / | awk 'NR==2 {print $4}')" [[ "$free_kb" =~ ^[0-9]+$ ]] || fatal "Ruang disk bebas tidak dapat dibaca." ((free_kb >= 307200)) \ || fatal "Ruang disk bebas kurang dari 300 MiB (${free_kb} KiB)." ok "IPv6 native aktif pada ${IFACE}: ${global_v6}" ok "Ruang disk memadai: $((free_kb / 1024)) MiB bebas." } check_tun_capability() { [[ -c /dev/net/tun ]] \ || fatal "/dev/net/tun tidak tersedia. Aktifkan TUN/TAP dari panel provider VPS." [[ -r /dev/net/tun && -w /dev/net/tun ]] \ || fatal "/dev/net/tun tidak dapat diakses baca/tulis oleh root." if (( CHECK_ONLY == 1 )); then ok "Device TUN tersedia (uji pembuatan interface dilewati pada --check-only)." return 0 fi TEMP_TUN="wpft$((RANDOM % 10000))" if ! ip tuntap add dev "$TEMP_TUN" mode tun >/dev/null 2>&1; then TEMP_TUN="" fatal "TUN ada tetapi kernel/container menolak pembuatan interface. Periksa CAP_NET_ADMIN/provider VPS." fi ip link delete "$TEMP_TUN" >/dev/null 2>&1 \ || fatal "Interface TUN preflight tidak dapat dibersihkan." TEMP_TUN="" ok "TUN dan CAP_NET_ADMIN siap." } curl_ipv6_probe() { local url="$1" timeout 30 curl -6 -fsS \ --connect-timeout 10 \ --max-time 25 \ --retry 2 \ --retry-delay 2 \ "$url" >/dev/null } check_ipv6_dns_https() { local http_code getent ahostsv6 pkg.cloudflareclient.com 2>/dev/null | grep -q ':' \ || fatal "DNS tidak mengembalikan AAAA untuk pkg.cloudflareclient.com." getent ahostsv6 engage.cloudflareclient.com 2>/dev/null | grep -q ':' \ || fatal "DNS tidak mengembalikan AAAA untuk engage.cloudflareclient.com." curl_ipv6_probe "https://www.cloudflare.com/cdn-cgi/trace" \ || fatal "HTTPS IPv6 ke Cloudflare tidak berfungsi." curl_ipv6_probe "https://pkg.cloudflareclient.com/" \ || fatal "Repository Cloudflare tidak dapat diakses melalui IPv6." http_code="$( timeout 30 curl -6 -sS -o /dev/null -w '%{http_code}' \ --connect-timeout 10 --max-time 25 \ https://engage.cloudflareclient.com/ 2>/dev/null \ || true )" [[ -n "$http_code" && "$http_code" != "000" ]] \ || fatal "Endpoint engage.cloudflareclient.com tidak dapat dijangkau melalui IPv6/TCP 443." ok "DNS dan HTTPS IPv6 ke Cloudflare/repository berfungsi." } prepare_repository_and_package() { local key_ascii key_gpg source_tmp candidate policy_output policy_rc local -a reinstall_opt=() log "Tahap 2/6: memvalidasi repository dan paket WARP sebelum pembersihan" TMP_DIR="$(mktemp -d /tmp/warp-ipv4-egress.XXXXXX)" key_ascii="${TMP_DIR}/cloudflare-pubkey.gpg" key_gpg="${TMP_DIR}/cloudflare-keyring.gpg" source_tmp="${TMP_DIR}/cloudflare-client.list" timeout 45 curl -6 -fsSL \ --connect-timeout 10 \ --max-time 40 \ --retry 3 \ --retry-delay 2 \ https://pkg.cloudflareclient.com/pubkey.gpg \ -o "$key_ascii" \ || fatal "GPG key Cloudflare gagal diunduh melalui IPv6." gpg --batch --yes --dearmor --output "$key_gpg" "$key_ascii" \ || fatal "GPG key Cloudflare gagal diproses." [[ -s "$key_gpg" ]] || fatal "Keyring Cloudflare kosong." printf 'deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ %s main\n' \ "$VERSION_CODENAME" >"$source_tmp" install -m 0644 "$key_gpg" /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg install -m 0644 "$source_tmp" /etc/apt/sources.list.d/cloudflare-client.list export DEBIAN_FRONTEND=noninteractive apt-get "${APT_OPTS[@]}" update \ || fatal "apt-get update repository gagal melalui IPv6." ok "Indeks repository selesai diperbarui." policy_output="" policy_rc=0 set +e policy_output="$(apt-cache policy cloudflare-warp 2>&1)" policy_rc=$? set -e if ((policy_rc != 0)); then printf '%s\n' "$policy_output" >&2 fatal "apt-cache policy cloudflare-warp gagal (exit ${policy_rc})." fi candidate="$( awk '$1 == "Candidate:" && !found {print $2; found=1}' \ <<<"$policy_output" )" [[ -n "$candidate" && "$candidate" != "(none)" ]] \ || { printf '%s\n' "$policy_output" >&2 fatal "Paket cloudflare-warp tidak tersedia untuk ${VERSION_CODENAME}/${ARCH}." } ok "Kandidat paket WARP ditemukan: ${candidate}" if dpkg-query -W -f='${Status}' cloudflare-warp 2>/dev/null \ | grep -q '^install ok installed$'; then reinstall_opt=(--reinstall) fi apt-get "${APT_OPTS[@]}" install -y --download-only --no-install-recommends \ "${reinstall_opt[@]}" cloudflare-warp \ || fatal "Paket/dependensi WARP tidak dapat diunduh penuh melalui IPv6." ok "Paket WARP kandidat ${candidate} tersedia dan dapat diunduh melalui IPv6." } backup_existing_state() { local timestamp local -a paths=() local -a rel_paths=() local path for path in \ "$BOOTSTRAP_UNIT" \ "$BOOTSTRAP_HELPER" \ "$WARP_DROPIN_FILE" \ "$LEGACY_DROPIN_FILE" \ "$STATE_DIR" \ /etc/cloudflare-warp \ /var/lib/cloudflare-warp \ /etc/apt/sources.list.d/cloudflare-client.list \ /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg; do [[ -e "$path" || -L "$path" ]] && paths+=("$path") done ((${#paths[@]} > 0)) || return 0 install -d -m 0700 "$BACKUP_DIR" timestamp="$(date '+%Y%m%d-%H%M%S')" BACKUP_FILE="${BACKUP_DIR}/preinstall-${timestamp}.tar.gz" for path in "${paths[@]}"; do rel_paths+=("${path#/}") done umask 077 tar -C / -czf "$BACKUP_FILE" --ignore-failed-read "${rel_paths[@]}" \ || fatal "Backup state lama gagal dibuat." chmod 0600 "$BACKUP_FILE" ok "Backup konfigurasi/state lama: ${BACKUP_FILE}" } stop_warp_safely() { if command -v warp-cli >/dev/null 2>&1; then timeout 10 warp-cli --accept-tos disconnect >/dev/null 2>&1 \ || timeout 10 warp-cli disconnect >/dev/null 2>&1 \ || true fi systemctl stop warp-svc.service >/dev/null 2>&1 || true local i for i in {1..10}; do systemctl is-active --quiet warp-svc.service || break sleep 1 done if systemctl is-active --quiet warp-svc.service; then systemctl kill --kill-who=all --signal=KILL warp-svc.service >/dev/null 2>&1 || true systemctl stop warp-svc.service >/dev/null 2>&1 || true fi } mask_warp_service() { stop_warp_safely systemctl unmask warp-svc.service >/dev/null 2>&1 || true systemctl mask --runtime warp-svc.service >/dev/null \ || fatal "warp-svc gagal di-mask sementara." WARP_MASKED_BY_SCRIPT=1 } unmask_warp_service() { systemctl unmask --runtime warp-svc.service >/dev/null 2>&1 || true systemctl unmask warp-svc.service >/dev/null 2>&1 || true WARP_MASKED_BY_SCRIPT=0 } remove_route_and_address() { local iface="$1" local address="$2" local prefix="$3" local gateway="$4" local metric="$5" [[ -n "$iface" ]] || return 0 validate_iface "$iface" || return 0 ip link show dev "$iface" >/dev/null 2>&1 || return 0 if [[ -n "$gateway" ]] && validate_ipv4 "$gateway"; then ip -4 route del default via "$gateway" dev "$iface" metric "${metric:-65000}" >/dev/null 2>&1 \ || ip -4 route del default via "$gateway" dev "$iface" >/dev/null 2>&1 \ || true fi if [[ -n "$address" && -n "$prefix" ]] \ && validate_ipv4 "$address" \ && [[ "$prefix" =~ ^[0-9]+$ ]]; then ip -4 addr del "${address}/${prefix}" dev "$iface" >/dev/null 2>&1 || true fi } cleanup_old_rollback_units() { systemctl stop \ "${LEGACY_ROLLBACK_UNIT}.timer" \ "${LEGACY_ROLLBACK_UNIT}.service" \ >/dev/null 2>&1 || true systemctl reset-failed \ "${LEGACY_ROLLBACK_UNIT}.timer" \ "${LEGACY_ROLLBACK_UNIT}.service" \ >/dev/null 2>&1 || true rm -f "$ROLLBACK_SCRIPT" } remove_managed_artifacts() { systemctl disable --now "$BOOTSTRAP_SERVICE" >/dev/null 2>&1 || true remove_route_and_address \ "$IFACE" "$DUMMY_IPV4" "$DUMMY_PREFIX" "$DUMMY_GATEWAY" "$DUMMY_METRIC" if [[ -n "$OLD_IFACE" ]]; then remove_route_and_address \ "$OLD_IFACE" "$OLD_DUMMY_IPV4" "$OLD_DUMMY_PREFIX" \ "$OLD_DUMMY_GATEWAY" "$OLD_DUMMY_METRIC" fi rm -f "$BOOTSTRAP_UNIT" "$BOOTSTRAP_HELPER" "$WARP_DROPIN_FILE" "$LEGACY_DROPIN_FILE" rmdir "$WARP_DROPIN_DIR" >/dev/null 2>&1 || true rm -rf "$STATE_DIR" ip link delete CloudflareWARP >/dev/null 2>&1 || true rm -rf /run/cloudflare-warp systemctl daemon-reload systemctl reset-failed warp-svc.service "$BOOTSTRAP_SERVICE" >/dev/null 2>&1 || true } fresh_cleanup() { log "Tahap 3/6: membersihkan instalasi lama agar benar-benar fresh" backup_existing_state cleanup_old_rollback_units mask_warp_service remove_managed_artifacts if dpkg-query -W -f='${Status}' cloudflare-warp 2>/dev/null \ | grep -q '^install ok installed$'; then apt-get "${APT_OPTS[@]}" purge -y cloudflare-warp \ || fatal "Paket cloudflare-warp lama gagal di-purge." fi rm -rf /etc/cloudflare-warp /var/lib/cloudflare-warp /var/log/cloudflare-warp /run/cloudflare-warp systemctl daemon-reload systemctl reset-failed warp-svc.service >/dev/null 2>&1 || true if dpkg-query -W -f='${Status}' cloudflare-warp 2>/dev/null \ | grep -q '^install ok installed$'; then fatal "Paket cloudflare-warp masih terpasang setelah purge." fi [[ ! -e /var/lib/cloudflare-warp ]] \ || fatal "State lama /var/lib/cloudflare-warp belum bersih." ok "Paket, registrasi, runtime, unit custom, route dummy, dan state lama sudah dibersihkan." } prepare_nonfresh_upgrade() { log "Tahap 3/6: menyiapkan upgrade tanpa menghapus registrasi WARP" backup_existing_state cleanup_old_rollback_units mask_warp_service remove_managed_artifacts ok "Registrasi/state WARP dipertahankan; unit dan route bootstrap lama dibersihkan." } install_warp_package() { log "Tahap 4/6: memasang paket Cloudflare WARP dengan daemon tetap ditahan" export DEBIAN_FRONTEND=noninteractive apt-get "${APT_OPTS[@]}" install -y --no-install-recommends cloudflare-warp \ || fatal "Instalasi paket cloudflare-warp gagal." dpkg-query -W -f='${Status}' cloudflare-warp 2>/dev/null \ | grep -q '^install ok installed$' \ || fatal "dpkg tidak menandai cloudflare-warp sebagai paket terpasang." command -v warp-cli >/dev/null 2>&1 || fatal "warp-cli tidak ditemukan setelah instalasi." command -v warp-svc >/dev/null 2>&1 || fatal "warp-svc tidak ditemukan setelah instalasi." unmask_warp_service systemctl daemon-reload systemctl cat warp-svc.service >/dev/null 2>&1 \ || fatal "Unit warp-svc.service tidak ditemukan setelah instalasi." init_warp_cli check_cli_capabilities ok "Paket terpasang: $(warp-cli --version 2>/dev/null || echo unknown)" } init_warp_cli() { if warp-cli --help 2>&1 | grep -q -- '--accept-tos'; then WARP_ACCEPT_TOS=1 else WARP_ACCEPT_TOS=0 fi } warp_cli() { if (( WARP_ACCEPT_TOS == 1 )); then command warp-cli --accept-tos "$@" else command warp-cli "$@" fi } warp_cli_timeout() { local duration="$1" shift if (( WARP_ACCEPT_TOS == 1 )); then timeout "$duration" warp-cli --accept-tos "$@" else timeout "$duration" warp-cli "$@" fi } check_cli_capabilities() { local help_text help_text="$(warp-cli registration --help 2>&1 || true)" grep -Eq '(^|[[:space:]])new([[:space:]]|$)' <<<"$help_text" \ || fatal "Versi warp-cli tidak menyediakan 'registration new'." help_text="$(warp-cli tunnel --help 2>&1 || true)" grep -Eq '(^|[[:space:]])protocol([[:space:]]|$)' <<<"$help_text" \ || fatal "Versi warp-cli tidak menyediakan pengaturan tunnel protocol." grep -Eq '(^|[[:space:]])ip([[:space:]]|$)' <<<"$help_text" \ || fatal "Versi warp-cli tidak menyediakan pengaturan split tunnel IP." help_text="$(warp-cli tunnel ip --help 2>&1 || true)" grep -q 'add-range' <<<"$help_text" \ || fatal "Versi warp-cli tidak menyediakan 'tunnel ip add-range'." ok "Kapabilitas CLI yang dibutuhkan tersedia." } arm_rollback() { cat >"$ROLLBACK_SCRIPT" <<EOF_ROLLBACK #!/usr/bin/env bash set +e timeout 8 warp-cli --accept-tos disconnect >/dev/null 2>&1 || timeout 8 warp-cli disconnect >/dev/null 2>&1 systemctl disable --now warp-svc.service >/dev/null 2>&1 systemctl disable --now ${BOOTSTRAP_SERVICE} >/dev/null 2>&1 ${IP_BIN} -4 route del default via ${DUMMY_GATEWAY} dev ${IFACE} metric ${DUMMY_METRIC} >/dev/null 2>&1 ${IP_BIN} -4 route del default via ${DUMMY_GATEWAY} dev ${IFACE} >/dev/null 2>&1 ${IP_BIN} -4 addr del ${DUMMY_IPV4}/${DUMMY_PREFIX} dev ${IFACE} >/dev/null 2>&1 rm -f ${BOOTSTRAP_UNIT} ${BOOTSTRAP_HELPER} ${WARP_DROPIN_FILE} rmdir ${WARP_DROPIN_DIR} >/dev/null 2>&1 rm -rf ${STATE_DIR} /run/cloudflare-warp systemctl daemon-reload >/dev/null 2>&1 systemctl restart ssh.service >/dev/null 2>&1 || systemctl restart sshd.service >/dev/null 2>&1 EOF_ROLLBACK chmod 0700 "$ROLLBACK_SCRIPT" systemd-run \ --quiet \ --unit="$ROLLBACK_UNIT" \ --on-active=10m \ --timer-property=AccuracySec=1s \ /bin/bash "$ROLLBACK_SCRIPT" \ || fatal "Timer rollback keselamatan gagal dibuat." ROLLBACK_ARMED=1 warn "Rollback keselamatan aktif selama 10 menit. Pertahankan console/noVNC sampai verifikasi selesai." } write_bootstrap_service() { log "Tahap 5/6: membuat bootstrap IPv4 dan memulai daemon secara terurut" install -d -m 0755 "$(dirname "$BOOTSTRAP_HELPER")" cat >"$BOOTSTRAP_HELPER" <<EOF_HELPER #!/usr/bin/env bash set -eu case "\${1:-}" in start) ${IP_BIN} -4 addr replace ${DUMMY_IPV4}/${DUMMY_PREFIX} dev ${IFACE} ${IP_BIN} -4 route replace default via ${DUMMY_GATEWAY} dev ${IFACE} onlink metric ${DUMMY_METRIC} ;; stop) ${IP_BIN} -4 route del default via ${DUMMY_GATEWAY} dev ${IFACE} metric ${DUMMY_METRIC} >/dev/null 2>&1 \ || ${IP_BIN} -4 route del default via ${DUMMY_GATEWAY} dev ${IFACE} >/dev/null 2>&1 \ || true ${IP_BIN} -4 addr del ${DUMMY_IPV4}/${DUMMY_PREFIX} dev ${IFACE} >/dev/null 2>&1 || true ;; *) echo "usage: \$0 {start|stop}" >&2 exit 2 ;; esac EOF_HELPER chmod 0755 "$BOOTSTRAP_HELPER" cat >"$BOOTSTRAP_UNIT" <<EOF_UNIT [Unit] Description=IPv4 bootstrap for Cloudflare WARP on an IPv6-only VPS Wants=network-online.target After=network-online.target Before=warp-svc.service ConditionPathExists=/sys/class/net/${IFACE} [Service] Type=oneshot RemainAfterExit=yes ExecStart=${BOOTSTRAP_HELPER} start ExecStop=${BOOTSTRAP_HELPER} stop [Install] WantedBy=multi-user.target EOF_UNIT install -d -m 0755 "$WARP_DROPIN_DIR" cat >"$WARP_DROPIN_FILE" <<EOF_DROPIN [Unit] Requires=${BOOTSTRAP_SERVICE} After=${BOOTSTRAP_SERVICE} EOF_DROPIN rm -f "$LEGACY_DROPIN_FILE" install -d -m 0700 "$STATE_DIR" cat >"$STATE_FILE" <<EOF_STATE IFACE=${IFACE} DUMMY_IPV4=${DUMMY_IPV4} DUMMY_PREFIX=${DUMMY_PREFIX} DUMMY_GATEWAY=${DUMMY_GATEWAY} DUMMY_METRIC=${DUMMY_METRIC} EOF_STATE chmod 0600 "$STATE_FILE" systemctl daemon-reload systemctl enable "$BOOTSTRAP_SERVICE" warp-svc.service >/dev/null systemctl restart "$BOOTSTRAP_SERVICE" ip -4 addr show dev "$IFACE" \ | grep -Fq "inet ${DUMMY_IPV4}/${DUMMY_PREFIX}" \ || fatal "IPv4 dummy gagal dipasang pada ${IFACE}." ip -4 route show default \ | grep -Fq "default via ${DUMMY_GATEWAY} dev ${IFACE}" \ || fatal "Default route IPv4 dummy gagal dibuat." verify_native_ipv6_route ok "IPv4 dummy aktif: ${DUMMY_IPV4}/${DUMMY_PREFIX}, gateway ${DUMMY_GATEWAY}, metric ${DUMMY_METRIC}." } verify_native_ipv6_route() { local route6 route6="$(ip -6 route get 2606:4700:4700::1111 2>/dev/null || true)" [[ -n "$route6" ]] || fatal "Route IPv6 hilang setelah perubahan IPv4." grep -Eq "dev[[:space:]]+${IFACE}([[:space:]]|$)" <<<"$route6" \ || fatal "IPv6 tidak lagi melalui ${IFACE}: ${route6}" } ipc_output_is_usable() { local output="$1" [[ -n "$output" ]] || return 1 if grep -Eqi \ 'unable to connect.*daemon|daemon.*not running|connection refused|no such file or directory|ipc.*(failed|error)' \ <<<"$output"; then return 1 fi return 0 } start_daemon_and_wait_for_ipc() { local i output rc restarted=0 rm -rf /run/cloudflare-warp install -d -m 0755 -o root -g root /run/cloudflare-warp systemctl reset-failed warp-svc.service >/dev/null 2>&1 || true systemctl start warp-svc.service \ || fatal "warp-svc.service gagal dimulai." for i in {1..60}; do output="" rc=0 set +e output="$(warp_cli_timeout 6 status 2>&1)" rc=$? set -e if systemctl is-active --quiet warp-svc.service \ && ((rc != 124 && rc != 137)) \ && ipc_output_is_usable "$output"; then ok "Daemon WARP aktif dan IPC/CLI merespons." return 0 fi if ((i == 30 && restarted == 0)); then warn "IPC belum siap setelah 30 detik; membersihkan runtime lalu restart daemon satu kali." stop_warp_safely rm -rf /run/cloudflare-warp install -d -m 0755 -o root -g root /run/cloudflare-warp systemctl start warp-svc.service || true restarted=1 fi sleep 1 done printf '%s\n' "${output:-warp-cli tidak menghasilkan output}" >&2 fatal "Daemon WARP aktif tetapi IPC/CLI tidak siap setelah 60 detik." } registration_is_present() { local output rc output="" rc=0 set +e output="$(warp_cli_timeout 20 registration show 2>&1)" rc=$? set -e ((rc == 0)) || return 1 grep -Eqi 'not registered|registration.*(missing|not found)|no registration|error:' <<<"$output" \ && return 1 [[ -n "$output" ]] } create_registration_once() { if (( WARP_ACCEPT_TOS == 1 )); then warp_cli_timeout 90 registration new else printf 'y\n' | timeout 90 warp-cli registration new fi } ensure_registration() { local attempt rc output if registration_is_present; then ok "Registrasi WARP sudah tersedia." return 0 fi warn "Registrasi WARP belum tersedia; membuat registrasi consumer baru." for attempt in 1 2 3; do output="" rc=0 set +e output="$(create_registration_once 2>&1)" rc=$? set -e [[ -n "$output" ]] && printf '%s\n' "$output" if registration_is_present; then ok "Registrasi WARP berhasil dibuat pada percobaan ${attempt}." return 0 fi if ((attempt < 3)); then warn "Registrasi belum tervalidasi (rc=${rc}); restart daemon dan mencoba lagi." stop_warp_safely rm -rf /run/cloudflare-warp install -d -m 0755 -o root -g root /run/cloudflare-warp systemctl start warp-svc.service || true start_daemon_and_wait_for_ipc fi done fatal "Registrasi WARP gagal setelah 3 percobaan. Rilis Linux terbaru memiliki known issue IPC; reboot server lalu jalankan ulang script dapat diperlukan." } configure_warp() { local ip_list warp_cli_timeout 20 mode warp \ || fatal "Gagal mengatur WARP ke traffic-only mode." warp_cli_timeout 20 tunnel protocol set MASQUE \ || fatal "Gagal mengatur protokol MASQUE." ip_list="$(warp_cli_timeout 20 tunnel ip list 2>&1 || true)" if grep -Eqi 'include mode|included routes' <<<"$ip_list"; then fatal "Split Tunnel terdeteksi dalam Include mode; script tidak akan mengubahnya karena berisiko mengalihkan IPv6." fi if ! grep -Eq '(^|[[:space:]])::/0([[:space:]]|$)' <<<"$ip_list"; then warp_cli_timeout 20 tunnel ip add-range ::/0 \ || fatal "Gagal menambahkan ::/0 ke Split Tunnel Exclude." fi ip_list="$(warp_cli_timeout 20 tunnel ip list 2>&1 || true)" grep -Eq '(^|[[:space:]])::/0([[:space:]]|$)' <<<"$ip_list" \ || fatal "::/0 tidak ditemukan setelah konfigurasi Split Tunnel." verify_native_ipv6_route ok "WARP disetel ke traffic-only/MASQUE dan semua IPv6 (::/0) dikecualikan." } status_is_connected() { local output="$1" grep -Eqi 'disconnected|not[[:space:]]+connected|unable|failed|error' <<<"$output" \ && return 1 grep -Eqi '(^|[^[:alpha:]])Connected([^[:alpha:]]|$)' <<<"$output" } wait_until_connected() { local i status rc set +e warp_cli_timeout 25 connect rc=$? set -e if ((rc != 0)); then warn "Perintah connect mengembalikan rc=${rc}; status akan tetap dipantau." fi status="" for i in {1..90}; do set +e status="$(warp_cli_timeout 8 status 2>&1)" rc=$? set -e if ((rc != 124 && rc != 137)) && status_is_connected "$status"; then printf '%s\n' "$status" ok "WARP tersambung." return 0 fi sleep 1 done printf '%s\n' "${status:-warp-cli status kosong}" >&2 fatal "WARP tidak mencapai status Connected dalam 90 detik." } verify_routes_and_connectivity() { local trace4 trace6 route6 service_enabled bootstrap_enabled trace4="$( timeout 35 curl -4 -fsS \ --connect-timeout 12 --max-time 30 \ https://www.cloudflare.com/cdn-cgi/trace )" || fatal "Tes HTTPS IPv4 melalui WARP gagal." grep -q '^warp=on$' <<<"$trace4" \ || fatal "IPv4 berhasil keluar tetapi trace tidak menunjukkan warp=on." route6="$(ip -6 route get 2606:4700:4700::1111 2>/dev/null || true)" grep -Eq "dev[[:space:]]+${IFACE}([[:space:]]|$)" <<<"$route6" \ || fatal "Route IPv6 tidak lagi melalui ${IFACE}." trace6="$( timeout 35 curl -6 -fsS \ --connect-timeout 12 --max-time 30 \ https://www.cloudflare.com/cdn-cgi/trace )" || fatal "Tes HTTPS IPv6 native gagal setelah WARP aktif." grep -q '^warp=off$' <<<"$trace6" \ || fatal "Trace IPv6 tidak menunjukkan warp=off; pengecualian ::/0 belum aman." systemctl is-active --quiet warp-svc.service \ || fatal "warp-svc tidak aktif setelah verifikasi." systemctl is-active --quiet "$BOOTSTRAP_SERVICE" \ || fatal "Bootstrap IPv4 tidak aktif setelah verifikasi." service_enabled="$(systemctl is-enabled warp-svc.service 2>/dev/null || true)" bootstrap_enabled="$(systemctl is-enabled "$BOOTSTRAP_SERVICE" 2>/dev/null || true)" [[ "$service_enabled" == "enabled" ]] \ || fatal "warp-svc belum enabled untuk boot." [[ "$bootstrap_enabled" == "enabled" ]] \ || fatal "Bootstrap IPv4 belum enabled untuk boot." printf '\n--- IPv4 trace ---\n' grep -E '^(ip|colo|loc|warp)=' <<<"$trace4" printf '\n--- IPv6 trace ---\n' grep -E '^(ip|colo|loc|warp)=' <<<"$trace6" printf '\n--- IPv6 route ---\n%s\n' "$route6" ok "IPv4 keluar melalui WARP; IPv6 dan SSH tetap pada interface native ${IFACE}." } disarm_rollback() { systemctl stop "${ROLLBACK_UNIT}.timer" "${ROLLBACK_UNIT}.service" >/dev/null 2>&1 || true systemctl reset-failed "${ROLLBACK_UNIT}.timer" "${ROLLBACK_UNIT}.service" >/dev/null 2>&1 || true rm -f "$ROLLBACK_SCRIPT" ROLLBACK_ARMED=0 } print_preflight_summary() { cat <<EOF_SUMMARY ============================================================ PREFLIGHT LULUS — belum ada instalasi/pembersihan dilakukan ============================================================ OS : ${PRETTY_NAME} (${VERSION_CODENAME}) Arsitektur : ${ARCH} Interface IPv6 : ${IFACE} IPv4 dummy target : ${DUMMY_IPV4}/${DUMMY_PREFIX} Dummy gateway : ${DUMMY_GATEWAY} (metric ${DUMMY_METRIC}) Fresh install : ${FRESH_INSTALL} ============================================================ EOF_SUMMARY } print_summary() { local public_v6 package_version public_v6="$( ip -6 -o addr show dev "$IFACE" scope global 2>/dev/null \ | awk '!found {print $4; found=1}' )" package_version="$(dpkg-query -W -f='${Version}' cloudflare-warp 2>/dev/null || echo unknown)" cat <<EOF_SUMMARY ============================================================ Cloudflare WARP IPv4 egress berhasil dipasang ============================================================ Script : ${SCRIPT_VERSION} Paket WARP : ${package_version} Interface : ${IFACE} IPv6 asli : ${public_v6:-unknown} IPv4 dummy : ${DUMMY_IPV4}/${DUMMY_PREFIX} Dummy gateway : ${DUMMY_GATEWAY} (metric ${DUMMY_METRIC}) WARP mode : traffic-only (warp) Tunnel : MASQUE IPv6 split route : ::/0 excluded Fresh install : ${FRESH_INSTALL} Backup lama : ${BACKUP_FILE:-tidak ada} Cek status: warp-cli --accept-tos status curl -4 -s https://www.cloudflare.com/cdn-cgi/trace | grep -E '^(ip|warp)=' curl -6 -s https://www.cloudflare.com/cdn-cgi/trace | grep -E '^(ip|warp)=' Catatan: - IPv4 WARP hanya untuk koneksi keluar. - SSH dan trafik IPv6 tetap menggunakan IPv6 asli VPS. - Jalankan dari console/noVNC saat melakukan perubahan routing berikutnya. ============================================================ EOF_SUMMARY } run_full_preflight() { log "Menjalankan preflight host IPv6-only" detect_interface IP_BIN="$(command -v ip)" read_old_managed_state check_ssh_safety check_ipv6_only_target check_ipv6_host_state check_tun_capability check_ipv6_dns_https ok "Semua pemeriksaan host dan konektivitas lulus." } main() { parse_args "$@" require_root check_inputs check_platform check_systemd acquire_lock bootstrap_dependencies run_full_preflight if (( CHECK_ONLY == 1 )); then print_preflight_summary INSTALL_SUCCESS=1 return 0 fi prepare_repository_and_package if (( FRESH_INSTALL == 1 )); then fresh_cleanup else prepare_nonfresh_upgrade fi detect_interface check_ipv6_host_state install_warp_package arm_rollback write_bootstrap_service start_daemon_and_wait_for_ipc ensure_registration configure_warp log "Tahap 6/6: menghubungkan dan memverifikasi jalur IPv4/IPv6" wait_until_connected verify_routes_and_connectivity disarm_rollback print_summary INSTALL_SUCCESS=1 } main "$@"