nas-tools/setup_clash_proxy.sh

#!/bin/bash

# Setup Clash proxy server on server2
# This will install Clash and configure it to work with Tailscale

echo "=== Setting up Clash proxy server on server2 ==="
echo ""

ssh server2 << 'EOF'
    set -e
    
    # Get Tailscale IP
    TAILSCALE_IP=$(tailscale ip -4)
    echo "Tailscale IP: $TAILSCALE_IP"
    echo ""
    
    # Create clash directory
    CLASH_DIR="$HOME/clash"
    mkdir -p "$CLASH_DIR"
    cd "$CLASH_DIR"
    
    # Download Clash (latest version)
    echo "Downloading Clash..."
    CLASH_VERSION="v1.20.0"
    ARCH="amd64"
    if [ "$(uname -m)" = "aarch64" ] || [ "$(uname -m)" = "arm64" ]; then
        ARCH="arm64"
    fi
    
    wget -q "https://github.com/Dreamacro/clash/releases/download/${CLASH_VERSION}/clash-linux-${ARCH}-${CLASH_VERSION}.gz" -O clash.gz
    gunzip -f clash.gz
    chmod +x clash
    
    # Create config directory
    mkdir -p ~/.config/clash
    
    # Create Clash configuration file
    cat > ~/.config/clash/config.yaml << CONFIG
# Clash configuration for server2 proxy
port: 7890
socks-port: 7891
allow-lan: true
bind-address: '*'
mode: rule
log-level: info
external-controller: 0.0.0.0:9090
external-ui: /root/.config/clash/ui

# DNS
dns:
  enable: true
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip
  nameserver:
    - 8.8.8.8
    - 1.1.1.1
  fallback:
    - 8.8.4.4
    - 1.0.0.1

# Proxy (direct connection - no upstream proxy needed)
proxies:
  - name: "direct"
    type: direct

# Proxy groups
proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - direct
  - name: "Auto"
    type: select
    proxies:
      - direct

# Rules - route all traffic through direct connection
rules:
  - MATCH,Proxy

# Experimental features
experimental:
  ignore-resolve-fail: true
CONFIG

    # Download Clash dashboard UI (optional but useful)
    echo "Downloading Clash UI..."
    if [ ! -d ~/.config/clash/ui ]; then
        cd ~/.config/clash
        wget -q https://github.com/haishanh/yacd/releases/latest/download/yacd.tar.xz -O yacd.tar.xz
        tar -xf yacd.tar.xz
        mv public ui
        rm yacd.tar.xz
    fi
    
    # Create systemd service
    echo "Creating systemd service..."
    sudo tee /etc/systemd/system/clash.service > /dev/null << SERVICE
[Unit]
Description=Clash daemon
After=network.target

[Service]
Type=simple
Restart=always
User=$USER
ExecStart=$CLASH_DIR/clash -d $HOME/.config/clash
Environment="HOME=$HOME"

[Install]
WantedBy=multi-user.target
SERVICE

    # Reload systemd and start Clash
    sudo systemctl daemon-reload
    sudo systemctl enable clash
    sudo systemctl restart clash
    
    # Wait a moment for service to start
    sleep 2
    
    # Check status
    if sudo systemctl is-active --quiet clash; then
        echo ""
        echo "✓ Clash is running!"
        echo ""
        echo "=== Configuration Summary ==="
        echo "HTTP Proxy: $TAILSCALE_IP:7890"
        echo "SOCKS5 Proxy: $TAILSCALE_IP:7891"
        echo "Web UI: http://$TAILSCALE_IP:9090/ui"
        echo ""
        echo "=== Firewall Configuration ==="
        echo "Checking firewall rules..."
        
        # Check if ufw is active
        if sudo ufw status | grep -q "Status: active"; then
            echo "UFW is active. Adding rules..."
            sudo ufw allow 7890/tcp comment "Clash HTTP"
            sudo ufw allow 7891/tcp comment "Clash SOCKS5"
            sudo ufw allow 9090/tcp comment "Clash Web UI"
            sudo ufw allow 53/udp comment "Clash DNS"
        else
            echo "UFW is not active. If using iptables, you may need to add rules manually."
        fi
        
        echo ""
        echo "=== Client Configuration ==="
        echo "For Clash clients, use this proxy:"
        echo "  Type: HTTP"
        echo "  Server: $TAILSCALE_IP"
        echo "  Port: 7890"
        echo ""
        echo "Or SOCKS5:"
        echo "  Type: SOCKS5"
        echo "  Server: $TAILSCALE_IP"
        echo "  Port: 7891"
    else
        echo "✗ Clash failed to start. Check logs with: sudo journalctl -u clash -n 50"
        exit 1
    fi
EOF

echo ""
echo "=== Setup Complete ==="
echo ""
echo "To check Clash status: ssh server2 'sudo systemctl status clash'"
echo "To view logs: ssh server2 'sudo journalctl -u clash -f'"