Remove ManagerPanel remote fallbacks: bundle-only install

Panel, udp-custom, udpgw and falconproxy are now installed exclusively from
/opt/firewallfalcon-bundle. The raw.githubusercontent and GitHub releases
fallbacks are gone; a missing bundle file is a hard error via the new
ff_require_bundle_file helper.

- menu.sh: drop PANEL_REPO_BASE and every remote download branch
- menu.sh: falconproxy no longer queries api.github.com for releases
- menu.sh: ARM udpgw can use an optional bundled udpgw-linux-arm64
  (the bundled udpgw is an x86-64 build), otherwise it builds from source
- install.sh: verify the staged bundle and mark binaries executable
- README: document the change and the remaining third-party dependencies

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -1,9 +1,13 @@
 # SSH-Manager (TNS243-GLOBAL Manager — self-contained bundle)
 
 `TNS243-GLOBAL/ManagerPanel`'in remote-bağımsız (offline) dağıtımı.
-Kurulum sırasında GitHub'a bağlanmaz; tüm binary'ler paketin içindedir.
+Kurulum sırasında GitHub'a bağlanmaz; tüm birinci-parti dosyalar paketin içindedir.
 `udp-custom` binary'lerinin UPX katmanı açılmış (unpacked) haldedir.
 
+Upstream (`ManagerPanel`) bağımlılığı tamamen kaldırılmıştır: panel, udp-custom,
+udpgw ve falconproxy artık **yalnızca** yerel bundle'dan kurulur. Dosya eksikse
+menü uzaktan indirmeye düşmez, hata verip durur.
+
 ## VPS kurulumu
 
 ### Yöntem 1 — Tek satır (önerilen)
@@ -31,4 +35,27 @@ sudo bash install.sh
 
 - `udp/udp-custom-linux-amd64` / `udp-custom-linux-arm`: UPX ile açılmış build'ler.
   Orijinal paketli haller dışarıda (`*.upxbackup`) tutulur ve bundle'a girmez.
-- Web panel: `menu` içinden kurulur, JSON tabanlı oturum yönetimi `/etc/firewallfalcon` altındadır.
+- Web panel: `menu` içinden kurulur, JSON tabanlı oturum yönetimi `/etc/firewallfalcon` altındadır.
+- `udp/udpgw` bir x86-64 build'idir. ARM64 sunucuda udpgw kaynaktan derlenir
+  (`ambrop72/badvpn`, internet gerekir). Tamamen offline ARM kurulumu için
+  arm64 derlenmiş bir udpgw'yi `udp/udpgw-linux-arm64` adıyla repoya koymak
+  yeterlidir; menü varsa otomatik onu kullanır.
+
+## Kalan internet bağımlılıkları (üçüncü taraf / opsiyonel)
+
+Aşağıdakiler `ManagerPanel` ile ilgili değildir; ilgili menü öğesi seçilmedikçe
+çalışmazlar:
+
+| Modül | Kaynak |
+|---|---|
+| badvpn (ve ARM'de udpgw derlemesi) | `github.com/ambrop72/badvpn` |
+| ZiVPN | `github.com/zahidbd2/udp-zivpn` releases |
+| DNSTT | `dnstt.network` |
+| 3x-ui / x-ui | `raw.githubusercontent.com/mhsanaei`, `alireza0` install script'leri |
+| DDNS | `desec.io` API |
+| Public IP tespiti | `icanhazip.com` |
+| SSL sertifikası | certbot / Let's Encrypt |
+| Paket kurulumu | dağıtımın apt/dnf depoları |
+
+Ayrıca web panel arayüzü `fonts.googleapis.com` üzerinden font çeker; internet
+yoksa yalnızca yazı tipi fallback'e düşer, işlevsellik etkilenmez.

install.sh

@@ -62,6 +62,25 @@ cp -r "$SCRIPT_DIR/release" "$BUNDLE_INSTALL_DIR/release"
 # Drop UPX packed originals from the bundle (unpacked binaries are used)
 rm -f "$BUNDLE_INSTALL_DIR"/udp/*.upxbackup
 
+# Verify the staged bundle: the menu has no remote fallback, so a missing file
+# here would surface later as a failed module install.
+for staged in \
+    "$BUNDLE_INSTALL_DIR/panel/panel.py" \
+    "$BUNDLE_INSTALL_DIR/panel/index.html" \
+    "$BUNDLE_INSTALL_DIR/udp/udp-custom-linux-amd64" \
+    "$BUNDLE_INSTALL_DIR/udp/udp-custom-linux-arm" \
+    "$BUNDLE_INSTALL_DIR/udp/udpgw" \
+    "$BUNDLE_INSTALL_DIR/release/falconproxy" \
+    "$BUNDLE_INSTALL_DIR/release/falconproxyarm"
+do
+    if [[ ! -s "$staged" ]]; then
+        echo "Error: Bundle staging failed, missing or empty: $staged"
+        exit 1
+    fi
+done
+chmod +x "$BUNDLE_INSTALL_DIR"/udp/udp-custom-linux-* "$BUNDLE_INSTALL_DIR"/udp/udpgw* \
+         "$BUNDLE_INSTALL_DIR"/release/falconproxy* 2>/dev/null || true
+
 # Install menu from the local copy
 cp "$SCRIPT_DIR/menu.sh" /usr/local/bin/menu
 chmod +x /usr/local/bin/menu

menu.sh

@@ -75,10 +75,22 @@ PANEL_HTML_FILE="$DB_DIR/panel/index.html"
 PANEL_CONF="$DB_DIR/panel.conf"
 PANEL_SERVICE_FILE="/etc/systemd/system/firewallfalcon-panel.service"
 PANEL_PORT=44380
-PANEL_REPO_BASE="https://raw.githubusercontent.com/TNS243-GLOBAL/ManagerPanel/main/panel"
 # Localized offline bundle (remote-independent install). Overridden by install.sh.
+# Every first-party asset (panel, udp-custom, udpgw, falconproxy) is read from here;
+# there is no remote fallback.
 FF_BUNDLE_DIR="${FF_BUNDLE_DIR:-/opt/firewallfalcon-bundle}"
 
+# Abort the caller when a required bundle asset is missing.
+ff_require_bundle_file() {
+    local path="$1"
+    if [[ ! -f "$path" ]]; then
+        echo -e "\n${C_RED}❌ Missing bundle file: $path${C_RESET}"
+        echo -e "${C_YELLOW}   The local bundle is incomplete. Re-run install.sh to restore it.${C_RESET}"
+        return 1
+    fi
+    return 0
+}
+
 # --- ZiVPN Variables ---
 ZIVPN_DIR="/etc/zivpn"
 ZIVPN_BIN="/usr/local/bin/zivpn"
@@ -2251,14 +2263,11 @@ install_udp_custom() {
     echo -e "\n${C_GREEN}⚙️ Detecting system architecture...${C_RESET}"
     local arch
     arch=$(uname -m)
-    local binary_url=""
     local binary_source=""
     if [[ "$arch" == "x86_64" ]]; then
-        binary_url="https://raw.githubusercontent.com/TNS243-GLOBAL/ManagerPanel/main/udp/udp-custom-linux-amd64"
         binary_source="udp-custom-linux-amd64"
         echo -e "${C_BLUE}ℹ️ Detected x86_64 (amd64) architecture.${C_RESET}"
     elif [[ "$arch" == "aarch64" || "$arch" == "arm64" ]]; then
-        binary_url="https://raw.githubusercontent.com/TNS243-GLOBAL/ManagerPanel/main/udp/udp-custom-linux-arm"
         binary_source="udp-custom-linux-arm"
         echo -e "${C_BLUE}ℹ️ Detected ARM64 architecture.${C_RESET}"
     else
@@ -2267,28 +2276,32 @@ install_udp_custom() {
         return
     fi
 
-    echo -e "\n${C_GREEN}📥 Installing udp-custom binary...${C_RESET}"
+    echo -e "\n${C_GREEN}📥 Installing udp-custom binary from local bundle...${C_RESET}"
-    if [[ -f "$FF_BUNDLE_DIR/udp/$binary_source" ]]; then
+    if ! ff_require_bundle_file "$FF_BUNDLE_DIR/udp/$binary_source"; then
-        echo -e "${C_BLUE}ℹ️ Using local bundle copy: $binary_source${C_RESET}"
+        rm -rf "$UDP_CUSTOM_DIR"
-        cp "$FF_BUNDLE_DIR/udp/$binary_source" "$UDP_CUSTOM_DIR/udp-custom"
+        return
-    else
-        wget -q --show-progress -O "$UDP_CUSTOM_DIR/udp-custom" "$binary_url"
-        if [ $? -ne 0 ]; then
-            echo -e "\n${C_RED}❌ Failed to download the udp-custom binary.${C_RESET}"
-            rm -rf "$UDP_CUSTOM_DIR"
-            return
-        fi
     fi
+    echo -e "${C_BLUE}ℹ️ Using local bundle copy: $binary_source${C_RESET}"
+    cp "$FF_BUNDLE_DIR/udp/$binary_source" "$UDP_CUSTOM_DIR/udp-custom"
     chmod +x "$UDP_CUSTOM_DIR/udp-custom"
 
     echo -e "\n${C_GREEN}📦 Setting up udpgw helper...${C_RESET}"
+    # The bundled udpgw is an x86-64 build; ARM uses an optional arm64 bundle copy,
+    # otherwise it is compiled from source.
+    local udpgw_source=""
     if [[ "$arch" == "x86_64" ]]; then
-        if [[ -f "$FF_BUNDLE_DIR/udp/udpgw" ]]; then
+        udpgw_source="$FF_BUNDLE_DIR/udp/udpgw"
-            echo -e "${C_BLUE}ℹ️ Using local bundle copy: udpgw${C_RESET}"
+        if ! ff_require_bundle_file "$udpgw_source"; then
-            cp "$FF_BUNDLE_DIR/udp/udpgw" "$UDPGW_BINARY"
+            rm -rf "$UDP_CUSTOM_DIR"
-        else
+            return
-            wget -q --show-progress -O "$UDPGW_BINARY" "https://raw.githubusercontent.com/http-custom/udp-custom/main/module/udpgw"
         fi
+    elif [[ -f "$FF_BUNDLE_DIR/udp/udpgw-linux-arm64" ]]; then
+        udpgw_source="$FF_BUNDLE_DIR/udp/udpgw-linux-arm64"
+    fi
+
+    if [[ -n "$udpgw_source" ]]; then
+        echo -e "${C_BLUE}ℹ️ Using local bundle copy: $(basename "$udpgw_source")${C_RESET}"
+        cp "$udpgw_source" "$UDPGW_BINARY"
         if [ ! -s "$UDPGW_BINARY" ]; then
             echo -e "\n${C_RED}❌ Failed to obtain the udpgw helper binary.${C_RESET}"
             rm -rf "$UDP_CUSTOM_DIR"
@@ -2296,7 +2309,7 @@ install_udp_custom() {
         fi
         chmod +x "$UDPGW_BINARY"
     else
-        echo -e "${C_YELLOW}ℹ️ Architecture is $arch. Compiling udpgw from source (this may take a minute)...${C_RESET}"
+        echo -e "${C_YELLOW}ℹ️ Architecture is $arch and no bundled arm64 udpgw was found. Compiling udpgw from source (needs internet, this may take a minute)...${C_RESET}"
         ff_pkg_install cmake g++ make git >/dev/null 2>&1
         local temp_build="/tmp/badvpn_build"
         rm -rf "$temp_build"
@@ -3437,53 +3450,13 @@ install_falcon_proxy() {
         if [[ "$confirm_reinstall" != "y" ]]; then return; fi
     fi
 
-    local use_local_bundle=false
+    # Falcon Proxy ships inside the local bundle; there is no remote release lookup.
-    if [[ -f "$FF_BUNDLE_DIR/release/falconproxy" || -f "$FF_BUNDLE_DIR/release/falconproxyarm" ]]; then
+    local SELECTED_VERSION="v0-websockets"
-        use_local_bundle=true
+    if [[ ! -f "$FF_BUNDLE_DIR/release/falconproxy" && ! -f "$FF_BUNDLE_DIR/release/falconproxyarm" ]]; then
-    fi
+        ff_require_bundle_file "$FF_BUNDLE_DIR/release/falconproxy"
-
+        return
-    local SELECTED_VERSION=""
-    if $use_local_bundle; then
-        SELECTED_VERSION="v0-websockets"
-        echo -e "${C_BLUE}ℹ️ Local bundle detected: using bundled release v0-websockets.${C_RESET}"
-    else
-        echo -e "\n${C_BLUE}🌐 Fetching available versions from GitHub...${C_RESET}"
-        local releases_json=$(curl -s "https://api.github.com/repos/TNS243-GLOBAL/ManagerPanel/releases")
-        if [[ -z "$releases_json" || "$releases_json" == "[]" ]]; then
-            echo -e "${C_RED}❌ Error: Could not fetch releases. Check internet or API limits.${C_RESET}"
-            return
-        fi
-
-        # Extract tag names
-        mapfile -t versions < <(echo "$releases_json" | jq -r '.[].tag_name')
-        
-        if [ ${#versions[@]} -eq 0 ]; then
-            echo -e "${C_RED}❌ No releases found in the repository.${C_RESET}"
-            return
-        fi
-
-        echo -e "\n${C_CYAN}Select a version to install:${C_RESET}"
-        for i in "${!versions[@]}"; do
-            printf "  ${C_GREEN}[%2d]${C_RESET} %s\n" "$((i+1))" "${versions[$i]}"
-        done
-        echo -e "  ${C_RED} [ 0]${C_RESET} ↩️ Cancel"
-        
-        local choice
-        while true; do
-            if ! read -r -p "👉 Enter version number [1]: " choice; then
-                echo
-                return
-            fi
-            choice=${choice:-1}
-            if [[ "$choice" == "0" ]]; then return; fi
-            if [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -le "${#versions[@]}" ]; then
-                SELECTED_VERSION="${versions[$((choice-1))]}"
-                break
-            else
-                echo -e "${C_RED}❌ Invalid selection.${C_RESET}"
-            fi
-        done
     fi
+    echo -e "${C_BLUE}ℹ️ Using bundled release $SELECTED_VERSION.${C_RESET}"
 
     local ports
     read -p "👉 Enter port(s) for Falcon Proxy (e.g., 8080 or 8080 8888) [8080]: " ports
@@ -3513,16 +3486,11 @@ install_falcon_proxy() {
         return
     fi
     
-    echo -e "\n${C_GREEN}📥 Installing Falcon Proxy $SELECTED_VERSION ($binary_name)...${C_RESET}"
+    echo -e "\n${C_GREEN}📥 Installing Falcon Proxy $SELECTED_VERSION ($binary_name) from local bundle...${C_RESET}"
-    if $use_local_bundle; then
+    ff_require_bundle_file "$FF_BUNDLE_DIR/release/$binary_name" || return
-        cp "$FF_BUNDLE_DIR/release/$binary_name" "$FALCONPROXY_BINARY"
+    cp "$FF_BUNDLE_DIR/release/$binary_name" "$FALCONPROXY_BINARY"
-    else
-        # Construct download URL based on selected version
-        local download_url="https://github.com/TNS243-GLOBAL/ManagerPanel/releases/download/$SELECTED_VERSION/$binary_name"
-        wget -q --show-progress -O "$FALCONPROXY_BINARY" "$download_url"
-    fi
     if [ ! -s "$FALCONPROXY_BINARY" ]; then
-        echo -e "\n${C_RED}❌ Failed to obtain the binary. Please ensure version $SELECTED_VERSION has asset '$binary_name'.${C_RESET}"
+        echo -e "\n${C_RED}❌ Failed to install the bundled binary '$binary_name'.${C_RESET}"
         return
     fi
     chmod +x "$FALCONPROXY_BINARY"
@@ -4363,32 +4331,26 @@ install_web_panel() {
     local panel_secret
     panel_secret="panel_$(tr -dc 'a-z0-9' < /dev/urandom | head -c 8)"
     
-    echo -e "${C_BLUE}📥 Downloading panel files...${C_RESET}"
+    echo -e "${C_BLUE}📥 Installing panel files from local bundle...${C_RESET}"
     mkdir -p "$PANEL_HTML_DIR"
-    
+
     # Install backend
-    if [[ -f "$FF_BUNDLE_DIR/panel/panel.py" ]]; then
+    ff_require_bundle_file "$FF_BUNDLE_DIR/panel/panel.py" || return
-        echo -e "${C_BLUE}ℹ️ Using local bundle copy: panel.py${C_RESET}"
+    echo -e "${C_BLUE}ℹ️ Using local bundle copy: panel.py${C_RESET}"
-        cp "$FF_BUNDLE_DIR/panel/panel.py" "$PANEL_SCRIPT"
+    cp "$FF_BUNDLE_DIR/panel/panel.py" "$PANEL_SCRIPT"
-    else
+    if [ ! -s "$PANEL_SCRIPT" ]; then
-        curl -sL "$PANEL_REPO_BASE/panel.py" -o "$PANEL_SCRIPT"
+        echo -e "${C_RED}❌ Failed to install panel backend.${C_RESET}"
-    fi
-    if [ $? -ne 0 ] || [ ! -s "$PANEL_SCRIPT" ]; then
-        echo -e "${C_RED}❌ Failed to obtain panel backend.${C_RESET}"
         return
     fi
     chmod +x "$PANEL_SCRIPT"
     sed -i 's/\r$//' "$PANEL_SCRIPT" 2>/dev/null
-    
+
     # Install frontend
-    if [[ -f "$FF_BUNDLE_DIR/panel/index.html" ]]; then
+    ff_require_bundle_file "$FF_BUNDLE_DIR/panel/index.html" || return
-        echo -e "${C_BLUE}ℹ️ Using local bundle copy: index.html${C_RESET}"
+    echo -e "${C_BLUE}ℹ️ Using local bundle copy: index.html${C_RESET}"
-        cp "$FF_BUNDLE_DIR/panel/index.html" "$PANEL_HTML_FILE"
+    cp "$FF_BUNDLE_DIR/panel/index.html" "$PANEL_HTML_FILE"
-    else
+    if [ ! -s "$PANEL_HTML_FILE" ]; then
-        curl -sL "$PANEL_REPO_BASE/index.html" -o "$PANEL_HTML_FILE"
+        echo -e "${C_RED}❌ Failed to install panel frontend.${C_RESET}"
-    fi
-    if [ $? -ne 0 ] || [ ! -s "$PANEL_HTML_FILE" ]; then
-        echo -e "${C_RED}❌ Failed to obtain panel frontend.${C_RESET}"
         return
     fi