Generate panel credentials securely

README.md

@@ -41,9 +41,9 @@
 curl -fsSL https://git.chardb.ru/AlexChard/telegram-web-proxy/raw/branch/main/install-shared-vps.sh -o /tmp/install-telegram-web-proxy.sh && sudo bash /tmp/install-telegram-web-proxy.sh --domain gg.chardwork.ru --email YOUR_EMAIL
 ```
 
-Скрипт запросит логин и пароль панели через терминал. Пароль не передаётся в аргументах и не сохраняется в shell history.
+Скрипт автоматически создаст длинный случайный пароль панели. Пароль не передаётся в аргументах и не сохраняется в shell history.
 
-После установки адрес панели, основной secret и готовая Telegram-ссылка сохраняются на VPS:
+После установки адрес панели, логин, пароль, основной secret и готовая Telegram-ссылка сохраняются на VPS:
 
 ```text
 /root/telegram-web-proxy-access.txt

install-shared-vps.sh

@@ -137,6 +137,10 @@ apt-get -o DPkg::Lock::Timeout=600 install -y --no-install-recommends \
   ca-certificates curl unzip socat python3 openssl git dnsutils nftables \
   build-essential libssl-dev util-linux zlib1g-dev
 
+PANEL_ADMIN="admin"
+PANEL_PASSWORD="$(openssl rand -base64 24 | tr -d '\n' | tr '/+' '_-')"
+[[ ${#PANEL_PASSWORD} -ge 20 ]] || die "Could not generate the panel password."
+
 WORK_DIR="$(mktemp -d /tmp/gg-web-proxy.XXXXXXXX)"
 ARCHIVE="$WORK_DIR/web-panel-proxy.zip"
 curl --fail --silent --show-error --location \
@@ -266,6 +270,36 @@ replacement = (
 if core.count(needle) != 1:
     raise SystemExit("Could not locate the canonical Caddy patch point")
 core = core.replace(needle, replacement)
+
+credentials_block = '''else
+    echo
+    read -r -p "Panel administrator login [admin]: " PANEL_ADMIN
+    PANEL_ADMIN="${PANEL_ADMIN:-admin}"
+    while true; do
+        read -r -s -p "Panel administrator password: " PANEL_PASS
+        echo
+        if [[ ${#PANEL_PASS} -lt 3 ]]; then
+            echo "Password must contain at least 3 characters."
+            continue
+        fi
+        break
+    done
+    printf '%s\\n%s\\n' "$PANEL_ADMIN" "$PANEL_PASS" > /etc/web-proxy-panel/install-credentials
+    chmod 0600 /etc/web-proxy-panel/install-credentials
+    unset PANEL_PASS
+fi'''
+credentials_replacement = '''else
+    PANEL_ADMIN="${WEBPROXY_PANEL_ADMIN:-admin}"
+    PANEL_PASS="${WEBPROXY_PANEL_PASSWORD:?WEBPROXY_PANEL_PASSWORD is required}"
+    [[ ${#PANEL_PASS} -ge 12 ]] || die "Generated panel password is too short."
+    printf '%s\\n%s\\n' "$PANEL_ADMIN" "$PANEL_PASS" > /etc/web-proxy-panel/install-credentials
+    chmod 0600 /etc/web-proxy-panel/install-credentials
+    unset PANEL_PASS
+    echo "      Generated panel credentials received securely."
+fi'''
+if core.count(credentials_block) != 1:
+    raise SystemExit("Could not locate the panel credentials block")
+core = core.replace(credentials_block, credentials_replacement)
 open(core_path, "w", encoding="utf-8").write(core)
 
 panel_src = open(panel_path, encoding="utf-8").read()
@@ -286,8 +320,9 @@ PY
 chmod 0700 "$SOURCE_DIR"/*.sh
 
 say "Installing the proxy and its private management panel"
-printf '\nThe panel installer will now ask only for its login and password.\n'
+WEBPROXY_PANEL_ADMIN="$PANEL_ADMIN" \
-bash "$SOURCE_DIR/install-final.sh" </dev/tty
+WEBPROXY_PANEL_PASSWORD="$PANEL_PASSWORD" \
+  bash "$SOURCE_DIR/install-final.sh"
 
 say "Installing the neutral Gradient Garden site"
 install -d -o root -g tproxy -m 0750 /srv/tproxy-site
@@ -338,6 +373,8 @@ PRIMARY_SECRET="$(cat /etc/web-proxy-panel/primary-secret)"
 cat > /root/telegram-web-proxy-access.txt <<EOF
 Domain: ${DOMAIN}
 Panel: https://${DOMAIN}${PANEL_PATH}/login
+Panel login: ${PANEL_ADMIN}
+Panel password: ${PANEL_PASSWORD}
 Primary secret: ${PRIMARY_SECRET}
 Telegram link: tg://webproxy?server=${DOMAIN}&port=443&secret=${PRIMARY_SECRET}
 Public site: https://${DOMAIN}/
@@ -354,4 +391,4 @@ printf '============================================================\n'
 printf ' Site:  https://%s/\n' "$DOMAIN"
 printf ' Panel: https://%s%s/login\n' "$DOMAIN" "$PANEL_PATH"
 printf ' Link:  tg://webproxy?server=%s&port=443&secret=%s\n' "$DOMAIN" "$PRIMARY_SECRET"
-printf '\nA private copy is saved in /root/telegram-web-proxy-access.txt\n'
+printf '\nPanel credentials and a private copy are saved in /root/telegram-web-proxy-access.txt\n'