bugfix: {{NC}} typo, bot TOML v3 parsing, add_secret v3 format

- install.sh: fix {{NC}} -> ${NC} color escape on line 265
- bot.py: fix TOML parsing for telemt v3 [access.users] format
- bot.py: fix telemt config section [server].port instead of [config].listen_port
- telemt_config.sh: fix add_secret_to_config() for v3 format

gotelegram-bot/bot.py

@@ -499,12 +499,15 @@ async def get_status_text() -> str:
         if "port" in config:
             lines.append(f"<b>Port:</b> {html.escape(str(config['port']))}")
 
-    # Telemt config
+    # Telemt config (v3: [server] port = ..., [censorship] tls_domain = ...)
     telemt_cfg = load_toml(TELEMT_CONFIG)
     if telemt_cfg:
-        cfg = telemt_cfg.get("config", {})
+        server_cfg = telemt_cfg.get("server", {})
-        if "listen_port" in cfg:
+        if "port" in server_cfg:
-            lines.append(f"<b>Listen Port:</b> {cfg['listen_port']}")
+            lines.append(f"<b>Listen Port:</b> {server_cfg['port']}")
+        censor_cfg = telemt_cfg.get("censorship", {})
+        if "tls_domain" in censor_cfg:
+            lines.append(f"<b>TLS Domain:</b> {html.escape(str(censor_cfg['tls_domain']))}")
 
     # Backups
     backup_count = 0
@@ -946,14 +949,15 @@ async def get_proxy_link() -> Optional[str]:
     if not config:
         return None
 
-    # Get secret from telemt TOML config
+    # Get secret from telemt TOML config (v3 format: [access.users] main = "...")
     secret = config.get("secret", "")
     if not secret:
         telemt_cfg = load_toml(TELEMT_CONFIG)
         if telemt_cfg:
-            users = telemt_cfg.get("users", [])
+            access = telemt_cfg.get("access", {})
-            if isinstance(users, list) and users:
+            users = access.get("users", {})
-                secret = users[0].get("secret", "")
+            if isinstance(users, dict):
+                secret = users.get("main", "")
     if not secret:
         return None
 
@@ -967,10 +971,16 @@ async def get_proxy_link() -> Optional[str]:
         faketls_secret = f"ee{secret}{domain_hex}"
         return f"tg://proxy?server={domain}&port={port}&secret={faketls_secret}"
 
-    # Lite-режим: IP
+    # Lite-режим: IP + fake-TLS с mask_host
     code, stdout, _ = await sh("curl", "-s", "-4", "--max-time", "5", "https://api.ipify.org")
     server = stdout.strip() if code == 0 and stdout.strip() else "0.0.0.0"
 
+    mask_host = config.get("mask_host", "")
+    if mask_host:
+        domain_hex = mask_host.encode().hex()
+        faketls_secret = f"ee{secret}{domain_hex}"
+        return f"tg://proxy?server={server}&port={port}&secret={faketls_secret}"
+
     return f"tg://proxy?server={server}&port={port}&secret={secret}"
 
 

install.sh

@@ -96,15 +96,13 @@ show_main_menu() {
     echo -e "  ${DIM}${line2}${NC}"
 
     # ── Прокси-ссылка + QR ──
+    local mask_host
+    mask_host=$(config_get mask_host 2>/dev/null || echo "")
     if [ -n "$secret" ] && [ "$proxy_status" = "running" ]; then
         if [ "$mode" = "pro" ] && [ -n "$domain" ]; then
-            local raw_secret faketls_secret domain_hex
+            link=$(generate_proxy_link "$domain" "$port" "$secret" "$domain")
-            raw_secret="$secret"
-            domain_hex=$(printf '%s' "$domain" | xxd -p | tr -d '\n')
-            faketls_secret="ee${raw_secret}${domain_hex}"
-            link="tg://proxy?server=${domain}&port=${port}&secret=${faketls_secret}"
         else
-            link="tg://proxy?server=${ip}&port=${port}&secret=${secret}"
+            link=$(generate_proxy_link "$ip" "$port" "$secret" "$mask_host")
         fi
 
         echo -e "  ${BOLD}${WHITE}Ссылка для Telegram:${NC}"
@@ -264,7 +262,7 @@ menu_install() {
     echo -e "  ${CYAN}2)${NC} ${MAGENTA}🛡  Pro${NC} — свой сайт + полная маскировка"
     echo -e "     ${DIM}nginx + SSL + HTML-шаблон + telemt.${NC}"
     echo -e "     ${DIM}DPI видит реальный сайт с реальным сертификатом.${NC}"
-    echo -e "     ${DIM}Требует: домен, направленный на этот сервер.{{NC}"
+    echo -e "     ${DIM}Требует: домен, направленный на этот сервер.${NC}"
     echo -e "  ${DIM}$(printf '─%.0s' {1..55})${NC}"
     echo -ne "  ${WHITE}Выбор (1/2):${NC} "
     read -r mode_choice
@@ -454,20 +452,18 @@ menu_status() {
 
 # ── Ссылка ───────────────────────────────────────────────────────────────────
 menu_link() {
-    local secret port ip link mode domain
+    local secret port ip link mode domain mask_host
     secret=$(get_config_value secret)
     port=$(get_config_value port)
     ip=$(get_server_ip)
     mode=$(config_get mode 2>/dev/null || echo "lite")
     domain=$(config_get domain 2>/dev/null || echo "")
+    mask_host=$(config_get mask_host 2>/dev/null || echo "")
 
     if [ "$mode" = "pro" ] && [ -n "$domain" ]; then
-        local domain_hex faketls_secret
+        link=$(generate_proxy_link "$domain" "$port" "$secret" "$domain")
-        domain_hex=$(printf '%s' "$domain" | xxd -p | tr -d '\n')
-        faketls_secret="ee${secret}${domain_hex}"
-        link="tg://proxy?server=${domain}&port=${port}&secret=${faketls_secret}"
     else
-        link=$(generate_proxy_link "$ip" "$port" "$secret")
+        link=$(generate_proxy_link "$ip" "$port" "$secret" "$mask_host")
     fi
 
     echo ""
@@ -483,21 +479,19 @@ menu_link() {
 
 # ── Поделиться ───────────────────────────────────────────────────────────────
 menu_share() {
-    local secret port ip link mode domain server_display
+    local secret port ip link mode domain mask_host server_display
     secret=$(get_config_value secret)
     port=$(get_config_value port)
     ip=$(get_server_ip)
     mode=$(config_get mode 2>/dev/null || echo "lite")
     domain=$(config_get domain 2>/dev/null || echo "")
+    mask_host=$(config_get mask_host 2>/dev/null || echo "")
 
     if [ "$mode" = "pro" ] && [ -n "$domain" ]; then
-        local domain_hex faketls_secret
+        link=$(generate_proxy_link "$domain" "$port" "$secret" "$domain")
-        domain_hex=$(printf '%s' "$domain" | xxd -p | tr -d '\n')
-        faketls_secret="ee${secret}${domain_hex}"
-        link="tg://proxy?server=${domain}&port=${port}&secret=${faketls_secret}"
         server_display="$domain"
     else
-        link=$(generate_proxy_link "$ip" "$port" "$secret")
+        link=$(generate_proxy_link "$ip" "$port" "$secret" "$mask_host")
         server_display="$ip"
     fi
 

lib/common.sh

@@ -225,7 +225,7 @@ install_pkg() {
 
 ensure_deps() {
     local missing=()
-    for cmd in curl jq openssl git; do
+    for cmd in curl jq openssl git qrencode; do
         if ! command -v "$cmd" &>/dev/null; then
             missing+=("$cmd")
         fi

lib/telemt_config.sh

@@ -81,13 +81,17 @@ add_secret_to_config() {
         return 1
     fi
 
-    # Добавляем новый блок [[users]]
+    # telemt v3: добавляем ключ в секцию [access.users]
+    # Формат: name = "secret" под блоком [access.users]
+    if grep -q '\[access\.users\]' "$config"; then
+        sed -i "/\[access\.users\]/a ${name} = \"${secret}\"" "$config"
+    else
         cat >> "$config" << EOSECRET
 
-[[users]]
+[access.users]
-  name = "${name}"
+${name} = "${secret}"
-  secret = "${secret}"
 EOSECRET
+    fi
 
     log_success "Добавлен секрет: $name"
 }
@@ -242,10 +246,19 @@ select_port() {
 
 # ── Генерация ссылки tg://proxy ──────────────────────────────────────────────
 generate_proxy_link() {
-    local ip="${1:-$(get_server_ip)}"
+    local server="${1:-$(get_server_ip)}"
     local port="${2:-443}"
     local secret="$3"
-    echo "tg://proxy?server=${ip}&port=${port}&secret=${secret}"
+    local mask_host="${4:-}"
+
+    # Если указан mask_host (fake-TLS), формируем ee-секрет
+    if [ -n "$mask_host" ]; then
+        local domain_hex
+        domain_hex=$(printf '%s' "$mask_host" | xxd -p | tr -d '\n')
+        secret="ee${secret}${domain_hex}"
+    fi
+
+    echo "tg://proxy?server=${server}&port=${port}&secret=${secret}"
 }
 
 # ── Вывод информации о прокси ────────────────────────────────────────────────
@@ -263,14 +276,11 @@ show_proxy_info() {
     mode=$(config_get mode 2>/dev/null || echo "lite")
     domain=$(config_get domain 2>/dev/null || echo "")
 
-    # Pro-режим: ссылка с доменом и fake-TLS секретом
+    # Генерация ссылки: оба режима используют ee-секрет с mask_host
     if [ "$mode" = "pro" ] && [ -n "$domain" ]; then
-        local domain_hex faketls_secret
+        link=$(generate_proxy_link "$domain" "$port" "$secret" "$domain")
-        domain_hex=$(printf '%s' "$domain" | xxd -p | tr -d '\n')
-        faketls_secret="ee${secret}${domain_hex}"
-        link="tg://proxy?server=${domain}&port=${port}&secret=${faketls_secret}"
     else
-        link=$(generate_proxy_link "$ip" "$port" "$secret")
+        link=$(generate_proxy_link "$ip" "$port" "$secret" "$mask_host")
     fi
 
     local status_icon status_text