Handle DNS propagation safely

README.md

@@ -35,6 +35,8 @@
 
 Перед запуском DNS-запись `gg.chardwork.ru` должна указывать на VPS. CDN или проксирование DNS-провайдера включать не нужно.
 
+Проверка выполняется через публичный DNS Cloudflare. Если системный resolver VPS ещё хранит старый NXDOMAIN, установщик временно добавляет точную запись в `/etc/hosts` и автоматически удаляет её при завершении или ошибке.
+
 ## Установка одной командой
 
 ```bash

install-shared-vps.sh

@@ -29,6 +29,7 @@ CADDYFILE=""
 DOH_URL="https://dns.chardwork.ru/dns-query?dns=AAABAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE"
 DOH_BASELINE=""
 INSTALL_COMPLETE=0
+TEMP_HOSTS_MARKER="# telegram-web-proxy temporary DNS"
 
 say() { printf '\n==> %s\n' "$*"; }
 die() { printf '\nERROR: %s\n' "$*" >&2; exit 1; }
@@ -57,6 +58,9 @@ valid_email() {
 }
 
 cleanup() {
+  if [[ -w /etc/hosts ]] && grep -Fq "$TEMP_HOSTS_MARKER" /etc/hosts 2>/dev/null; then
+    sed -i "\\|$TEMP_HOSTS_MARKER|d" /etc/hosts
+  fi
   [[ -z "$WORK_DIR" || ! -d "$WORK_DIR" ]] || rm -rf -- "$WORK_DIR"
 }
 
@@ -116,10 +120,17 @@ for port in "$RELAY_BRIDGE_PORT" "$PANEL_BRIDGE_PORT" 2398 8080 8081 8090; do
 done
 
 say "Checking DNS and the existing DoH service"
-DNS_IP="$(getent ahostsv4 "$DOMAIN" | awk 'NR==1{print $1}')"
-[[ -n "$DNS_IP" ]] || die "No IPv4 A record found for $DOMAIN."
 VPS_IP="$(curl -4fsS --max-time 10 https://api.ipify.org)"
-[[ "$DNS_IP" == "$VPS_IP" ]] || die "$DOMAIN resolves to $DNS_IP, but this VPS is $VPS_IP."
+DNS_IP="$(getent ahostsv4 "$DOMAIN" | awk 'NR==1{print $1}')"
+PUBLIC_DNS_IP="$(dig +short A "$DOMAIN" @1.1.1.1 | tail -n1)"
+[[ "$PUBLIC_DNS_IP" == "$VPS_IP" ]] ||
+  die "$DOMAIN resolves through public DNS to ${PUBLIC_DNS_IP:-nothing}, but this VPS is $VPS_IP."
+if [[ "$DNS_IP" != "$VPS_IP" ]]; then
+  grep -Eq "(^|[[:space:]])${DOMAIN//./\\.}([[:space:]]|$)" /etc/hosts &&
+    die "/etc/hosts already contains an unexpected entry for $DOMAIN."
+  printf '%s %s %s\n' "$VPS_IP" "$DOMAIN" "$TEMP_HOSTS_MARKER" >> /etc/hosts
+  echo "      The VPS resolver is still caching NXDOMAIN; a temporary local entry was added."
+fi
 DOH_BASELINE="$(curl -fsS -o /dev/null -w '%{http_code}' --max-time 8 "$DOH_URL" || true)"
 [[ "$DOH_BASELINE" == 200 ]] || die "Existing DoH check failed before installation (HTTP ${DOH_BASELINE:-error})."