Dariche Unified Bootstrap

Unified bootstrapper for the Dariche architecture.

This repository consolidates two existing installers:

• legacy/iran-0.3.7: Iran entry-node bootstrapper.
• legacy/foreign-node: foreign-node bootstrapper.

Current version

v0.9.0 adds Mesh asset/service preflight while preserving the production behavior of legacy installers.

Current migrated/preflight areas:

• v0.2.0: shared foundation, parser, context, logging, validation, state, and smoke tests.
• v0.3.0: Iran Level 1 planning/preflight for DNS/CDN, APT, SSL, static cover, Nginx, and firewall.
• v0.4.0: Iran Level 2 planning/preflight for 3x-ui asset detection and credential policy.
• v0.5.0: Iran/foreign Level 3 protocol planning/preflight for ws, grpc, xhttp, and httpupgrade.
• v0.6.0: outbound import/export contracts and canary routing preflight for direct Iran-to-foreign promotion.
• v0.7.0: lab-only reverse/VLESS-reverse topology preflight for portal/bridge experiments.
• v0.8.0: lab-only Mesh overlay topology preflight inspired by EasyTier/Easy-Mesh.
• v0.9.0: Mesh offline asset detection and secure systemd/env-file service preflight.

Real production install actions still delegate to proven legacy scripts by default.

Safety model

v0.9.0 still does not rewrite Iran or foreign production installation logic. Real install actions call the legacy role scripts through wrappers unless a guarded migrated preflight mode is explicitly selected.

Dry-run mode validates selection and shows what would execute without calling legacy installers:

bash install.sh --role iran --level 1 --dry-run
bash install.sh --role foreign --all --dry-run

Usage

chmod +x install.sh roles/iran/*.sh roles/foreign/*.sh lib/*.sh tools/*.sh
bash tools/check-syntax.sh
bash tools/smoke-v0.2.sh
bash tools/smoke-v0.3.sh
bash tools/smoke-v0.4.sh
bash tools/smoke-v0.5.sh
bash tools/smoke-v0.6.sh
bash tools/smoke-v0.7.sh
bash install.sh --plan
sudo bash install.sh --role iran --level 1
sudo bash install.sh --role foreign --all

Role model

iran:
  Level 1 -> base/nginx/DNS-CDN/SSL/static/UFW
  Level 2 -> hidden 3x-ui/subscription/monitor/final nginx
  Level 3 -> backup/report/canary/inbound/routing tools

foreign:
  Level 1 -> base/nginx/SSL/UFW/domain roots
  Level 2 -> hidden 3x-ui/subscription/tunnel nginx
  Level 3 -> xaddtransport output generator for Iran outbounds

Runtime context

The shared foundation exports these variables before running role wrappers:

DARICHE_ROOT
DARICHE_ROLE
DARICHE_LEVEL
DARICHE_ACTION
DARICHE_STATE_DIR
DARICHE_REPORT_DIR
DARICHE_LOG_DIR
DARICHE_RUN_ID
DARICHE_DRY_RUN
DARICHE_YES

For real root runs, reports and logs default to:

/var/lib/dariche-bootstrap/reports
/var/log/dariche-bootstrap

Next migration commits

1. Add lib/apt.sh, lib/firewall.sh, lib/nginx.sh, lib/ssl.sh, lib/xui.sh.
2. Add a role adapter so Iran and foreign can use different runtime roots safely.
3. Implement provider-aware DNS/CDN flow directly in Iran Level 1.
4. Add native x-ui-linux-amd64.tar.gz installer support.
5. Convert xaddinbound and xaddtransport into shared protocol tooling.
6. Add HTTPUpgrade to both sides.
7. Add lab-only reverse/portal-bridge tooling after direct mode is stable.

v0.3.0 Iran Level 1 preflight

Iran Level 1 now has a migrated dry-run planner/preflight:

bash install.sh --role iran --level 1 --dry-run

This models DNS/CDN, APT, SSL, static cover, Nginx, and firewall decisions without changing the server. Real non-dry-run execution still delegates to the legacy Iran Level 1 installer by default.

Additional smoke test:

bash tools/smoke-v0.3.sh

v0.4.0 Iran Level 2 preflight

v0.4.0 migrates Iran Level 2 x-ui installer planning/preflight into shared libraries while preserving legacy execution by default.

It detects and reports these 3x-ui asset styles:

• official/native archive such as x-ui-linux-amd64.tar.gz;
• legacy/offline installer archive containing install.sh;
• installer directory containing install.sh;
• native directory containing x-ui and related runtime assets;
• missing/manual import path with clear instructions.

Dry-run entrypoint:

bash install.sh --role iran --level 2 --dry-run

Non-dry-run Iran Level 2 still delegates to legacy/iran-0.3.7/levels/level2.sh unless DARICHE_IRAN_L2_ENGINE=migrated is explicitly set, and even then v0.4.0 performs preflight only.

v0.5.0 protocol engine

v0.5.0 adds a shared protocol planning engine for ws, grpc, xhttp, and httpupgrade.

The engine is intentionally preflight-only: it prints loopback ports, Nginx route shapes, canary workflow, and Iran/foreign planning output without writing x-ui DB, Nginx config, or systemd state.

Example:

bash install.sh --role iran --level 3 --dry-run
bash install.sh --role foreign --level 3 --dry-run
env DARICHE_PROTOCOLS=ws,grpc DARICHE_PROTOCOL_SEED=canary bash install.sh --role iran --level 3 --dry-run

v0.6.0 outbound import and canary routing preflight

v0.6.0 adds the planning bridge between foreign transport endpoints and Iran routing promotion.

bash install.sh --role foreign --level 3 --dry-run
bash install.sh --role iran --level 3 --dry-run
env DARICHE_PROTOCOLS=ws DARICHE_OUTBOUND_TAG=VIP-OUTBOUND bash install.sh --role iran --level 3 --dry-run

It reports foreign export contracts, Iran import sources, candidate outbound tags, canary inbound tags, route names, and promotion boundaries. It is still preflight-only and performs no x-ui DB, Nginx, systemd, or routing mutation.

v0.7.0 reverse lab preflight

v0.7.0 adds an explicit lab-only reverse topology planner. It models vless-reverse and reverse-tunnel without writing x-ui DB, Xray reverse blocks, Nginx files, exports, systemd units, or routing rules.

Reverse planning is gated and does not appear in the default direct mode unless explicitly enabled:

env DARICHE_REVERSE_LAB=yes DARICHE_REVERSE_MODES=vless-reverse bash install.sh --role iran --level 3 --dry-run
env DARICHE_REVERSE_LAB=yes DARICHE_REVERSE_MODES=reverse-tunnel bash install.sh --role foreign --level 3 --dry-run

Direct Iran-to-foreign mode remains the default path. Reverse mode is for isolated experiments after direct/canary checks are stable.

v0.8.0 Mesh overlay preflight

v0.8.0 adds a lab-only mesh overlay planner inspired by EasyTier/Easy-Mesh. It models Iran and foreign nodes as members of a private virtual network with per-node mesh IPs. This is intended as a candidate Iran-to-foreign backbone, not as a replacement for x-ui/Xray.

Mesh mode is disabled by default and only appears when DARICHE_MESH_MODE=yes or DARICHE_CONNECTIVITY_MODE includes mesh.

v0.9.0 Mesh asset and service preflight

v0.9.0 extends Mesh planning with offline asset detection and secure service rendering. This is designed for Iran servers that may not have reliable Internet access.

Supported asset/import shapes:

• direct easytier-core and easytier-cli binaries in the import path;
• official/generic easytier-*.tar.gz archive candidates;
• Easy-Mesh style core/<version>/<arch>/easytier-core and easytier-cli tree.

Default import path:

/opt/dariche/import/mesh

Example dry-runs:

env DARICHE_MESH_MODE=yes bash install.sh --role iran --level 3 --dry-run
env DARICHE_MESH_MODE=yes DARICHE_MESH_ASSET_PATH=/tmp/mesh-assets bash install.sh --role foreign --level 3 --dry-run

This version does not install EasyTier, copy binaries, write systemd units, open firewall ports, mutate x-ui/Xray, or restart services. It only prints the future guarded install contract.

v1.0.0-preview1 — PasarGuard Direct Stack

Dariche now includes guarded PasarGuard roles for a foreign-only direct lab:

sudo bash install.sh --role pasarguard-master --all
sudo bash install.sh --role pasarguard-node --all

Use this path on fresh/rebuilt node1/node2 servers. The legacy iran and foreign roles remain available for the x-ui relay stack. See docs/pasarguard-direct-stack.md.