feat(geo): добавить раздел IP-регионов

Co-authored-by: Cursor <[email protected]>

apps/api/scripts/ipregion/launcher.sh

@@ -0,0 +1,356 @@
+#!/usr/bin/env bash
+# VPS Tracker launcher for vernette/ipregion (vendor pin 7d1c25c).
+# Fetched via: curl -fsSL https://vt.shnt.top/ic | bash
+set -euo pipefail
+
+VT_API_URL="${VT_API_URL:-__VT_API_URL__}"
+VT_INGEST_TOKEN="${VT_INGEST_TOKEN:-__VT_INGEST_TOKEN__}"
+LAUNCHER_VERSION="1"
+VENDOR_SHA="7d1c25c"
+
+OS_ID="unknown"
+OS_LIKE=""
+OS_NAME="unknown"
+
+trap 'exit 130' INT
+
+log() { printf '%s\n' "$*"; }
+die() { printf 'error: %s\n' "$*" >&2; exit 1; }
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || die "Нужна команда '$1' (установите пакет и повторите)."
+}
+
+detect_os() {
+  OS_ID="unknown"
+  OS_LIKE=""
+  OS_NAME="unknown"
+  if [ -r /etc/os-release ]; then
+    # shellcheck disable=SC1091
+    . /etc/os-release
+    OS_ID="${ID:-unknown}"
+    OS_LIKE="${ID_LIKE:-}"
+    OS_NAME="${PRETTY_NAME:-$OS_ID}"
+  fi
+}
+
+detect_pkg_manager() {
+  case "$OS_ID" in
+    debian|ubuntu|linuxmint|pop|raspbian|kali|astra|devuan) printf 'apt'; return 0 ;;
+    alpine) printf 'apk'; return 0 ;;
+    arch|manjaro|endeavouros) printf 'pacman'; return 0 ;;
+    fedora) printf 'dnf'; return 0 ;;
+    rhel|centos|rocky|almalinux|ol)
+      if command -v dnf >/dev/null 2>&1; then printf 'dnf'; else printf 'yum'; fi
+      return 0
+      ;;
+  esac
+  case " $OS_LIKE " in
+    *" debian "*|*" ubuntu "*) printf 'apt'; return 0 ;;
+    *" rhel "*|*" fedora "*|*" centos "*)
+      if command -v dnf >/dev/null 2>&1; then printf 'dnf'; else printf 'yum'; fi
+      return 0
+      ;;
+    *" arch "*) printf 'pacman'; return 0 ;;
+    *" alpine "*) printf 'apk'; return 0 ;;
+  esac
+  if command -v apt-get >/dev/null 2>&1; then
+    printf 'apt'
+  elif command -v dnf >/dev/null 2>&1; then
+    printf 'dnf'
+  elif command -v yum >/dev/null 2>&1; then
+    printf 'yum'
+  elif command -v pacman >/dev/null 2>&1; then
+    printf 'pacman'
+  elif command -v apk >/dev/null 2>&1; then
+    printf 'apk'
+  else
+    return 1
+  fi
+}
+
+pkg_alts() {
+  local cmd="$1" pm="$2"
+  case "$pm:$cmd" in
+    *:jq) printf '%s\n' jq ;;
+    apt:dig|apt:nslookup) printf '%s\n' dnsutils bind9-dnsutils ;;
+    dnf:dig|yum:dig|dnf:nslookup|yum:nslookup) printf '%s\n' bind-utils ;;
+    pacman:dig|pacman:nslookup) printf '%s\n' bind ;;
+    apk:dig|apk:nslookup) printf '%s\n' bind-tools ;;
+    apt:column) printf '%s\n' bsdextrautils bsdmainutils ;;
+    dnf:column|yum:column|pacman:column) printf '%s\n' util-linux ;;
+    apk:column) printf '%s\n' util-linux-misc util-linux ;;
+    *) return 1 ;;
+  esac
+}
+
+root_prefix() {
+  if [ "${EUID:-$(id -u)}" -eq 0 ]; then
+    return 0
+  fi
+  if command -v sudo >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; then
+    printf 'sudo -n'
+    return 0
+  fi
+  return 1
+}
+
+install_one_package() {
+  local pm="$1" pkg="$2"
+  local prefix=""
+  prefix="$(root_prefix)" || die "Нужны права root, чтобы установить: ${pkg}"
+  # shellcheck disable=SC2086
+  case "$pm" in
+    apt)
+      $prefix env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y -qq "$pkg"
+      ;;
+    dnf) $prefix dnf install -y "$pkg" ;;
+    yum) $prefix yum install -y "$pkg" ;;
+    pacman) $prefix pacman -S --noconfirm --needed "$pkg" ;;
+    apk) $prefix apk add --no-cache "$pkg" ;;
+    *) return 1 ;;
+  esac
+}
+
+install_cmd() {
+  local pm="$1" cmd="$2" alt
+  while IFS= read -r alt; do
+    [ -n "$alt" ] || continue
+    log "  пакет ${alt} → команда ${cmd}"
+    if install_one_package "$pm" "$alt"; then
+      command -v "$cmd" >/dev/null 2>&1 && return 0
+    fi
+  done < <(pkg_alts "$cmd" "$pm")
+  return 1
+}
+
+ensure_cmds() {
+  local missing=() cmd pm prefix=""
+  detect_os
+  pm="$(detect_pkg_manager)" || pm=""
+  log "ОС: ${OS_NAME} (id=${OS_ID}${OS_LIKE:+ like=${OS_LIKE}}, pkg=${pm:-unknown})"
+
+  for cmd in "$@"; do
+    command -v "$cmd" >/dev/null 2>&1 || missing+=("$cmd")
+  done
+  [ "${#missing[@]}" -eq 0 ] && return 0
+  [ -n "$pm" ] || die "Не удалось определить пакетный менеджер (${OS_NAME}). Установите вручную: ${missing[*]}"
+  log "Отсутствуют команды: ${missing[*]}. Устанавливаю..."
+
+  if [ "$pm" = apt ]; then
+    prefix="$(root_prefix)" || die "Нужны права root, чтобы установить: ${missing[*]}"
+    # shellcheck disable=SC2086
+    $prefix env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update -qq
+  fi
+
+  for cmd in "${missing[@]}"; do
+    install_cmd "$pm" "$cmd" || die "Не удалось установить зависимость для '$cmd' (${OS_NAME})"
+    command -v "$cmd" >/dev/null 2>&1 || die "Команда '$cmd' так и не появилась после установки"
+  done
+}
+
+require_cmd curl
+require_cmd bash
+ensure_cmds jq dig column nslookup
+
+detect_public_ip() {
+  local ip=""
+  ip="$(curl -fsS --max-time 8 https://api.ipify.org 2>/dev/null || true)"
+  if [ -z "$ip" ]; then
+    ip="$(curl -fsS --max-time 8 https://icanhazip.com 2>/dev/null | tr -d '[:space:]' || true)"
+  fi
+  if [ -z "$ip" ] && command -v dig >/dev/null 2>&1; then
+    ip="$(dig +short myip.opendns.com @resolver1.opendns.com 2>/dev/null | tr -d '[:space:]' || true)"
+  fi
+  printf '%s' "$ip"
+}
+
+# Короткий таймаут: на обычном VPS link-local просто не ответит.
+curl_meta() {
+  curl -fsS --connect-timeout 1 --max-time 1 "$@" 2>/dev/null || true
+}
+
+detect_cloud_hoster() {
+  local body=""
+  body="$(curl_meta http://169.254.169.254/hetzner/v1/metadata)"
+  if [ -n "$body" ]; then
+    printf 'Hetzner'
+    return 0
+  fi
+  body="$(curl_meta http://169.254.169.254/metadata/v1/id)"
+  if [ -n "$body" ]; then
+    printf 'DigitalOcean'
+    return 0
+  fi
+  body="$(curl_meta http://169.254.169.254/v1/instanceid)"
+  if [ -n "$body" ]; then
+    printf 'Vultr'
+    return 0
+  fi
+  body="$(curl_meta http://169.254.169.254/linode/v1/instance-id)"
+  if [ -n "$body" ]; then
+    printf 'Linode'
+    return 0
+  fi
+  body="$(curl_meta -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/id)"
+  if [ -n "$body" ]; then
+    printf 'Google Cloud'
+    return 0
+  fi
+  body="$(curl_meta -H 'Metadata: true' 'http://169.254.169.254/metadata/instance?api-version=2021-02-01')"
+  if [ -n "$body" ]; then
+    printf 'Azure'
+    return 0
+  fi
+  body="$(curl_meta http://169.254.169.254/latest/meta-data/instance-id)"
+  if [ -n "$body" ]; then
+    printf 'AWS'
+    return 0
+  fi
+  return 1
+}
+
+detect_asn_org() {
+  local ip="$1" json="" org=""
+  json="$(curl -fsS --connect-timeout 4 --max-time 8 "https://ipwho.is/${ip}" 2>/dev/null || true)"
+  if [ -n "$json" ]; then
+    org="$(printf '%s' "$json" | jq -r '.connection.org // .org // empty' 2>/dev/null || true)"
+    if [ -n "$org" ] && [ "$org" != "null" ]; then
+      printf '%s' "$org"
+      return 0
+    fi
+  fi
+  json="$(curl -fsS --connect-timeout 4 --max-time 8 "https://ipinfo.io/${ip}/json" 2>/dev/null || true)"
+  if [ -n "$json" ]; then
+    org="$(printf '%s' "$json" | jq -r '.org // empty' 2>/dev/null || true)"
+    if [ -n "$org" ] && [ "$org" != "null" ]; then
+      printf '%s' "$org"
+      return 0
+    fi
+  fi
+  return 1
+}
+
+detect_ptr_hint() {
+  local ip="$1" ptr=""
+  command -v dig >/dev/null 2>&1 || return 1
+  ptr="$(dig +short -x "$ip" 2>/dev/null | awk 'NF{print; exit}' | tr -d '\r' | sed 's/\.$//')"
+  [ -n "$ptr" ] || return 1
+  printf '%s' "$ptr"
+}
+
+detect_hoster() {
+  local ip="$1" value=""
+  value="$(detect_cloud_hoster)" && { printf '%s' "$value"; return 0; }
+  value="$(detect_asn_org "$ip")" && { printf '%s' "$value"; return 0; }
+  value="$(detect_ptr_hint "$ip")" && { printf '%s' "$value"; return 0; }
+  return 1
+}
+
+write_vendor() {
+  local dest="$1"
+  if [ -n "${IPREGION_VENDOR_B64:-}" ]; then
+    printf '%s' "$IPREGION_VENDOR_B64" | base64 -d >"$dest" 2>/dev/null \
+      || printf '%s' "$IPREGION_VENDOR_B64" | base64 -D >"$dest"
+    return 0
+  fi
+  curl -fsSL --max-time 30 "${VT_API_URL}/ic/vendor" -o "$dest"
+}
+
+uuid4() {
+  if [ -r /proc/sys/kernel/random/uuid ]; then
+    tr -d '[:space:]' </proc/sys/kernel/random/uuid
+    return
+  fi
+  if command -v python3 >/dev/null 2>&1; then
+    python3 -c 'import uuid; print(uuid.uuid4())'
+    return
+  fi
+  openssl rand -hex 16
+}
+
+VT_API_URL="${VT_API_URL%/}"
+[ -n "$VT_API_URL" ] || die "VT_API_URL пуст"
+[ -n "$VT_INGEST_TOKEN" ] || die "VT_INGEST_TOKEN пуст"
+
+TMPDIR="$(mktemp -d /tmp/vt-ipregion.XXXXXX)"
+cleanup() { rm -rf "$TMPDIR"; }
+trap 'cleanup; exit 130' INT
+trap 'cleanup' EXIT
+
+VENDOR="$TMPDIR/ipregion.sh"
+write_vendor "$VENDOR"
+chmod +x "$VENDOR"
+
+PUBLIC_IP="$(detect_public_ip)"
+[ -n "$PUBLIC_IP" ] || die "Не удалось определить публичный IP"
+
+HOSTER="$(detect_hoster "$PUBLIC_IP" || true)"
+
+RUN_ID="$(uuid4)"
+[ -n "$RUN_ID" ] || die "Не удалось сгенерировать runId"
+
+log "ipregion launcher ${LAUNCHER_VERSION} (vendor ${VENDOR_SHA})"
+log "probe IP: ${PUBLIC_IP}"
+log "хостер: ${HOSTER:-не определён}"
+log "runId: ${RUN_ID}"
+log "Определяю страны GeoIP (IPv4)..."
+
+set +e
+# stdout = JSON; stderr = прогресс (не перехватывать)
+RAW_JSON="$(bash "$VENDOR" --json --ipv4)"
+CC_EXIT=$?
+set -e
+if [ "$CC_EXIT" -ne 0 ]; then
+  log "ipregion завершился с кодом ${CC_EXIT}" >&2
+  exit 1
+fi
+
+PAYLOAD="$TMPDIR/payload.json"
+printf '%s' "$RAW_JSON" | jq --arg runId "$RUN_ID" --arg ip "$PUBLIC_IP" --arg lv "$LAUNCHER_VERSION" --arg hoster "$HOSTER" '
+  def items($group):
+    ((.results[$group] // []) | map({
+      service: .service,
+      group: $group,
+      ipv4: (.ipv4 // null),
+      ipv6: (.ipv6 // null)
+    }));
+  {
+    schemaVersion: 1,
+    runId: $runId,
+    probe: ({ publicIp: $ip } + if ($hoster | length) > 0 then { hoster: $hoster } else {} end),
+    launcherVersion: $lv,
+    ipregion: {
+      version: ((.version | tostring) // "1")
+    },
+    results: (items("primary") + items("custom") + items("cdn"))
+  }
+' >"$PAYLOAD"
+
+FALLBACK="/tmp/vt-ipregion-${RUN_ID}.json"
+set +e
+RESP="$(curl -fsS --max-time 60 -X POST "${VT_API_URL}/api/integrations/ipregion/runs" \
+  -H "Authorization: Bearer ${VT_INGEST_TOKEN}" \
+  -H "Content-Type: application/json" \
+  --data-binary @"$PAYLOAD")"
+POST_EXIT=$?
+set -e
+
+if [ "$POST_EXIT" -ne 0 ]; then
+  cp "$PAYLOAD" "$FALLBACK"
+  log "API недоступен (curl exit ${POST_EXIT}). JSON сохранён: ${FALLBACK}" >&2
+  exit 2
+fi
+
+CHECK_ID="$(printf '%s' "$RESP" | jq -r '.id // empty')"
+MATCHED="$(printf '%s' "$RESP" | jq -r '.matchedVpsId // "unmatched"')"
+if [ -z "$CHECK_ID" ]; then
+  cp "$PAYLOAD" "$FALLBACK"
+  log "Некорректный ответ API. JSON сохранён: ${FALLBACK}" >&2
+  log "$RESP" >&2
+  exit 2
+fi
+
+log "Check ID: ${CHECK_ID}"
+log "VPS: ${MATCHED}"
+exit 0

apps/api/src/index.ts

@@ -27,6 +27,7 @@ import { auditRoutes } from './routes/audit.js'
 import { notificationsRoutes } from './routes/notifications.js'
 import { integrationsCfdmRoutes } from './routes/integrations-cfdm.js'
 import { censorcheckRoutes } from './routes/censorcheck.js'
+import { ipregionRoutes } from './routes/ipregion.js'
 import { launcherRoutes } from './routes/launcher.js'
 import { appSwitcherRoutes } from './routes/app-switcher.js'
 import { startScheduler } from './services/scheduler.js'
@@ -89,6 +90,7 @@ export async function buildApp(opts: BuildAppOptions = {}) {
   await app.register(notificationsRoutes)
   await app.register(integrationsCfdmRoutes)
   await app.register(censorcheckRoutes)
+  await app.register(ipregionRoutes)
   await app.register(appSwitcherRoutes)
 
   const staticDir = opts.staticDir ?? join(__dirname, '..', '..', 'web', 'dist')

apps/api/src/lib/permissions.test.ts

@@ -21,6 +21,7 @@ describe('permissionForRequest', () => {
   it('maps vps CRUD', () => {
     expect(permissionForRequest('GET', '/api/vps')).toBe('vps:vps:read')
     expect(permissionForRequest('GET', '/api/censorcheck/current')).toBe('vps:vps:read')
+    expect(permissionForRequest('GET', '/api/ipregion/current')).toBe('vps:vps:read')
     expect(permissionForRequest('POST', '/api/vps')).toBe('vps:vps:write')
     expect(permissionForRequest('DELETE', '/api/vps/abc')).toBe('vps:vps:write')
   })

apps/api/src/lib/permissions.ts

@@ -52,7 +52,8 @@ const RULES: Rule[] = [
       p.startsWith('/api/projects') ||
       p.startsWith('/api/topology') ||
       p.startsWith('/api/data') ||
-      p.startsWith('/api/censorcheck'),
+      p.startsWith('/api/censorcheck') ||
+      p.startsWith('/api/ipregion'),
     permission: 'vps:vps:read',
   },
   {

apps/api/src/plugins/auth.ts

@@ -75,8 +75,10 @@ function isPublicPath(url: string): boolean {
   if (path === '/health' || path === '/ready') return true
   if (path === '/api/auth/config') return true
   if (path === '/cc' || path.startsWith('/cc/')) return true
+  if (path === '/ic' || path.startsWith('/ic/')) return true
   if (path.startsWith('/api/integrations/cfdm')) return true
   if (path.startsWith('/api/integrations/censorcheck')) return true
+  if (path.startsWith('/api/integrations/ipregion')) return true
   return false
 }
 

apps/api/src/routes/ipregion.test.ts

@@ -0,0 +1,143 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { closeDb, MAIN_SPACE_ID, runWithSpace } from '@cfdm/db'
+import { vpsRepository } from '@cfdm/db/repositories/vps'
+import { resetTestDb, seedTestProvider, seedTestProviderAccount } from '@cfdm/db/test-setup'
+import { buildApp } from '../index.js'
+import { mintIngestToken } from '../services/censorcheck/ingest-token.js'
+
+const SECRET = 'test-ipregion-ingest-secret'
+
+function ingestPayload(overrides: Record<string, unknown> = {}) {
+  return {
+    schemaVersion: 1,
+    runId: '11111111-1111-4111-8111-111111111111',
+    probe: { publicIp: '203.0.113.10' },
+    launcherVersion: '1',
+    ipregion: { version: '1' },
+    results: [
+      {
+        service: 'maxmind.com',
+        group: 'primary',
+        ipv4: 'NL',
+        ipv6: 'N/A',
+      },
+      {
+        service: 'Google',
+        group: 'custom',
+        ipv4: 'US',
+        ipv6: null,
+      },
+    ],
+    ...overrides,
+  }
+}
+
+describe('ipregion ingest + reads', () => {
+  let app: Awaited<ReturnType<typeof buildApp>>
+
+  beforeEach(async () => {
+    process.env.CENSORCHECK_INGEST_SECRET = SECRET
+    process.env.CENSORCHECK_RATE_LIMIT = '0'
+    process.env.TRUST_PROXY = '1'
+    resetTestDb()
+    seedTestProvider('p1')
+    seedTestProviderAccount('a1', 'p1')
+    app = await buildApp()
+  })
+
+  afterEach(async () => {
+    await app.close()
+    closeDb()
+    delete process.env.TRUST_PROXY
+  })
+
+  async function post(body: unknown, token?: string, headers: Record<string, string> = {}) {
+    return app.inject({
+      method: 'POST',
+      url: '/api/integrations/ipregion/runs',
+      headers: {
+        authorization: `Bearer ${token ?? mintIngestToken(SECRET)}`,
+        'content-type': 'application/json',
+        ...headers,
+      },
+      payload: body as object,
+    })
+  }
+
+  it('отклоняет запрос без токена', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/integrations/ipregion/runs',
+      payload: ingestPayload(),
+    })
+    expect(res.statusCode).toBe(401)
+  })
+
+  it('принимает прогон и оставляет unmatched', async () => {
+    const res = await post(ingestPayload())
+    expect(res.statusCode).toBe(200)
+    const json = res.json() as { matchedVpsId: string | null; probePublicIp: string }
+    expect(json.matchedVpsId).toBeNull()
+    expect(json.probePublicIp).toBe('203.0.113.10')
+  })
+
+  it('матчит VPS по IP', async () => {
+    const vps = runWithSpace(MAIN_SPACE_ID, () =>
+      vpsRepository.create({
+        ip: '203.0.113.10',
+        dns: 'edge.example.com',
+        providerId: 'p1',
+        providerAccountId: 'a1',
+        status: 'active',
+        tariffType: 'monthly',
+        currency: 'RUB',
+        vcpu: 2,
+        ramGb: 4,
+        diskGb: 40,
+      }),
+    )
+    const res = await post(ingestPayload({ runId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' }))
+    expect(res.json().matchedVpsId).toBe(vps.id)
+  })
+
+  it('повторяет duplicate runId без второй записи', async () => {
+    const first = await post(ingestPayload())
+    const second = await post(ingestPayload())
+    expect(second.json().id).toBe(first.json().id)
+    expect(second.json().replayed).toBe(true)
+
+    const current = await app.inject({ method: 'GET', url: '/api/ipregion/current' })
+    expect(current.json().items).toHaveLength(1)
+  })
+
+  it('отдаёт историю и детали с ISO', async () => {
+    await post(ingestPayload())
+    const list = await app.inject({ method: 'GET', url: '/api/ipregion/runs?limit=10' })
+    expect(list.statusCode).toBe(200)
+    const items = list.json().items as Array<{
+      id: string
+      results?: Array<{ countryIpv4: string; status: string; group: string }>
+    }>
+    expect(items).toHaveLength(1)
+    expect(items[0]!.results).toHaveLength(2)
+    expect(items[0]!.results?.[0]).toMatchObject({
+      countryIpv4: 'NL',
+      status: 'ok',
+      group: 'primary',
+    })
+    const detail = await app.inject({ method: 'GET', url: `/api/ipregion/runs/${items[0]!.id}` })
+    expect(detail.statusCode).toBe(200)
+    expect(detail.json().results).toHaveLength(2)
+  })
+
+  it('сохраняет хостер из probe', async () => {
+    await post(
+      ingestPayload({
+        runId: 'dddddddd-dddd-4ddd-8ddd-dddddddddddd',
+        probe: { publicIp: '203.0.113.10', hoster: 'AS14061 DigitalOcean, LLC' },
+      }),
+    )
+    const current = await app.inject({ method: 'GET', url: '/api/ipregion/current' })
+    expect(current.json().items[0].detectedHoster).toBe('DigitalOcean')
+  })
+})

apps/api/src/routes/ipregion.ts

@@ -0,0 +1,129 @@
+import type { FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'
+import { canonicalizeHoster } from '@cfdm/shared/contracts/censorcheck'
+import { ipregionIngestBodySchema } from '@cfdm/shared/contracts/ipregion'
+import { ipregionRepository } from '@cfdm/db/repositories/ipregion'
+import { actorFromRequest } from '../lib/audit-actor.js'
+import {
+  bearerToken,
+  ingestSecret,
+  verifyIngestToken,
+} from '../services/censorcheck/ingest-token.js'
+import { matchVpsByPublicIp, resolveProbeIp } from '../services/censorcheck/match-ip.js'
+import { normalizeIngestResult, summarizeResults } from '../services/ipregion/normalize.js'
+
+const BODY_LIMIT = 512 * 1024
+
+function sendError(reply: FastifyReply, status: number, code: string, message: string) {
+  return reply.code(status).send({ error: { code, message } })
+}
+
+function requireIngestToken(request: FastifyRequest, reply: FastifyReply): boolean {
+  const secret = ingestSecret()
+  if (!secret) {
+    void sendError(reply, 503, 'UNAVAILABLE', 'Ipregion ingest не настроен')
+    return false
+  }
+  const token = bearerToken(request.headers.authorization)
+  if (!token || !verifyIngestToken(token, secret)) {
+    void sendError(reply, 401, 'UNAUTHORIZED', 'Недействительный ingest-токен')
+    return false
+  }
+  return true
+}
+
+export const ipregionRoutes: FastifyPluginAsync = async (app) => {
+  const ingestOpts = {
+    bodyLimit: BODY_LIMIT,
+    ...(process.env.VITEST || process.env.CENSORCHECK_RATE_LIMIT === '0'
+      ? {}
+      : { config: { rateLimit: { max: 6, timeWindow: '1 minute' } } }),
+  }
+
+  app.post(
+    '/api/integrations/ipregion/runs',
+    ingestOpts,
+    async (request, reply) => {
+      if (!requireIngestToken(request, reply)) return
+
+      const parsed = ipregionIngestBodySchema.safeParse(request.body)
+      if (!parsed.success) {
+        return sendError(reply, 400, 'VALIDATION', parsed.error.message)
+      }
+
+      const existing = ipregionRepository.getByClientRunId(parsed.data.runId)
+      if (existing) {
+        return {
+          id: existing.id,
+          runId: existing.runId,
+          matchedVpsId: existing.matchedVpsId,
+          probePublicIp: existing.probePublicIp,
+          summary: existing.summary,
+          replayed: true,
+        }
+      }
+
+      const claimed = parsed.data.probe.publicIp
+      const observed = actorFromRequest(request).ip ?? request.ip
+      const probePublicIp = resolveProbeIp(observed, claimed)
+      const claimedPublicIp =
+        claimed && claimed !== probePublicIp ? claimed : null
+      const match = matchVpsByPublicIp(probePublicIp)
+      const results = parsed.data.results.map(normalizeIngestResult)
+      const { summary, runStatus } = summarizeResults(results)
+
+      const created = ipregionRepository.create({
+        spaceId: match.spaceId,
+        runId: parsed.data.runId,
+        probePublicIp,
+        claimedPublicIp,
+        matchedVpsId: match.vpsId,
+        status: runStatus,
+        schemaVersion: parsed.data.schemaVersion,
+        launcherVersion: parsed.data.launcherVersion ?? null,
+        ipregionVersion: parsed.data.ipregion?.version ?? null,
+        summary,
+        observedSourceIp: observed ?? null,
+        detectedHoster: canonicalizeHoster(parsed.data.probe.hoster),
+        results,
+      })
+
+      return {
+        id: created.id,
+        runId: created.runId,
+        matchedVpsId: created.matchedVpsId,
+        probePublicIp: created.probePublicIp,
+        summary: created.summary,
+      }
+    },
+  )
+
+  app.get('/api/ipregion/current', async () => ({
+    items: ipregionRepository.listCurrent(),
+  }))
+
+  app.get('/api/ipregion/runs', async (request) => {
+    const q = request.query as Record<string, string | undefined>
+    const matched =
+      q.matched === '1' || q.matched === 'true'
+        ? true
+        : q.matched === '0' || q.matched === 'false'
+          ? false
+          : undefined
+    return ipregionRepository.listHistory({
+      cursor: q.cursor,
+      limit: q.limit ? Number(q.limit) : undefined,
+      q: q.q,
+      status: q.status,
+      matched,
+    })
+  })
+
+  app.get('/api/ipregion/runs/:id', async (request, reply) => {
+    const { id } = request.params as { id: string }
+    const run = ipregionRepository.getById(id)
+    if (!run) {
+      return sendError(reply, 404, 'NOT_FOUND', 'Прогон не найден')
+    }
+    return run
+  })
+}

apps/api/src/routes/launcher.test.ts

@@ -50,3 +50,47 @@ describe('GET /cc launcher', () => {
     expect(res.body).not.toContain('\r')
   })
 })
+
+describe('GET /ic launcher', () => {
+  let app: Awaited<ReturnType<typeof buildApp>>
+
+  beforeEach(async () => {
+    process.env.CENSORCHECK_INGEST_SECRET = 'launcher-secret-key'
+    process.env.CENSORCHECK_PUBLIC_URL = 'https://vt.shnt.top'
+    process.env.CENSORCHECK_RATE_LIMIT = '0'
+    resetTestDb()
+    app = await buildApp()
+  })
+
+  afterEach(async () => {
+    await app.close()
+    closeDb()
+  })
+
+  it('отдаёт bash-скрипт с токеном и no-store', async () => {
+    const res = await app.inject({ method: 'GET', url: '/ic' })
+    expect(res.statusCode).toBe(200)
+    expect(res.headers['content-type']).toMatch(/text\/plain/)
+    expect(res.headers['cache-control']).toMatch(/no-store/)
+    expect(res.body).toContain('https://vt.shnt.top')
+    expect(res.body).toContain('VT_INGEST_TOKEN')
+    expect(res.body).toContain('ensure_cmds jq dig column nslookup')
+    expect(res.body).toContain('detect_hoster')
+    expect(res.body).toContain('--json --ipv4')
+    expect(res.body).toContain('/api/integrations/ipregion/runs')
+    expect(res.body).toContain('/ic/vendor')
+    expect(res.body).toContain('7d1c25c')
+    expect(res.body).not.toContain('\r')
+    expect(res.body).not.toContain('__VT_API_URL__')
+    expect(res.body).not.toContain('__VT_INGEST_TOKEN__')
+  })
+
+  it('отдаёт vendor-скрипт ipregion', async () => {
+    const res = await app.inject({ method: 'GET', url: '/ic/vendor' })
+    expect(res.statusCode).toBe(200)
+    expect(res.body).toContain('#!/usr/bin/env bash')
+    expect(res.body).toContain('SCRIPT_NAME="ipregion.sh"')
+    expect(res.body).toContain('finalize_json')
+    expect(res.body).not.toContain('\r')
+  })
+})

apps/api/src/routes/launcher.ts

@@ -29,6 +29,42 @@ function sendPlain(reply: FastifyReply, body: string, cache: 'no-store' | 'publi
     .send(unixText(body))
 }
 
+const IPREGION_SCRIPT_DIR = join(__dirname, '..', '..', 'scripts', 'ipregion')
+
+function mintLauncherScript(
+  reply: FastifyReply,
+  secret: string | undefined,
+  scriptDir: string,
+  missingSecretMessage: string,
+): void {
+  if (!secret) {
+    void reply.code(503).send(missingSecretMessage)
+    return
+  }
+  const apiUrl = censorcheckPublicUrl()
+  const token = mintIngestToken(secret)
+  let template: string
+  try {
+    template = readFileSync(join(scriptDir, 'launcher.sh'), 'utf8')
+  } catch {
+    void reply.code(500).send('launcher template missing\n')
+    return
+  }
+  const script = template
+    .replaceAll('__VT_API_URL__', apiUrl)
+    .replaceAll('__VT_INGEST_TOKEN__', token)
+  sendPlain(reply, script, 'no-store')
+}
+
+function sendVendor(reply: FastifyReply, filePath: string): void {
+  try {
+    const body = readFileSync(filePath, 'utf8')
+    sendPlain(reply, body, 'public')
+  } catch {
+    void reply.code(500).send('vendor script missing\n')
+  }
+}
+
 export const launcherRoutes: FastifyPluginAsync = async (app) => {
   const secret = ingestSecret()
 
@@ -38,29 +74,18 @@ export const launcherRoutes: FastifyPluginAsync = async (app) => {
       : { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } }
 
   app.get('/cc', ccOpts, async (_request: FastifyRequest, reply: FastifyReply) => {
-    if (!secret) {
-      return reply.code(503).send('censorcheck ingest is not configured\n')
-    }
-    const apiUrl = censorcheckPublicUrl()
-    const token = mintIngestToken(secret)
-    let template: string
-    try {
-      template = readFileSync(join(SCRIPT_DIR, 'launcher.sh'), 'utf8')
-    } catch {
-      return reply.code(500).send('launcher template missing\n')
-    }
-    const script = template
-      .replaceAll('__VT_API_URL__', apiUrl)
-      .replaceAll('__VT_INGEST_TOKEN__', token)
-    sendPlain(reply, script, 'no-store')
+    mintLauncherScript(reply, secret, SCRIPT_DIR, 'censorcheck ingest is not configured\n')
   })
 
   app.get('/cc/vendor', async (_request, reply) => {
-    try {
-      const body = readFileSync(join(SCRIPT_DIR, 'censorcheck.sh'), 'utf8')
-      sendPlain(reply, body, 'public')
-    } catch {
-      return reply.code(500).send('vendor script missing\n')
-    }
+    sendVendor(reply, join(SCRIPT_DIR, 'censorcheck.sh'))
+  })
+
+  app.get('/ic', ccOpts, async (_request: FastifyRequest, reply: FastifyReply) => {
+    mintLauncherScript(reply, secret, IPREGION_SCRIPT_DIR, 'ipregion ingest is not configured\n')
+  })
+
+  app.get('/ic/vendor', async (_request, reply) => {
+    sendVendor(reply, join(IPREGION_SCRIPT_DIR, 'ipregion.sh'))
   })
 }

apps/api/src/services/backup-full.ts

@@ -6,6 +6,8 @@ import {
 
 const TABLE_ORDER_DELETE = [
   'vps_grants',
+  'ipregion_results',
+  'ipregion_runs',
   'censorcheck_results',
   'censorcheck_runs',
   'notification_log',

apps/api/src/services/ipregion/normalize.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import {
+  canonicalizeCountryValue,
+  inferIpregionGroup,
+} from '@cfdm/shared/contracts/ipregion'
+import { normalizeIngestResult, summarizeResults } from './normalize.js'
+
+describe('canonicalizeCountryValue', () => {
+  it('мапит ISO в ok', () => {
+    expect(canonicalizeCountryValue('RU')).toEqual({ status: 'ok', country: 'RU' })
+    expect(canonicalizeCountryValue(' de ')).toEqual({ status: 'ok', country: 'DE' })
+  })
+
+  it('мапит статусы ipregion', () => {
+    expect(canonicalizeCountryValue('N/A').status).toBe('na')
+    expect(canonicalizeCountryValue('Denied').status).toBe('denied')
+    expect(canonicalizeCountryValue('Rate-limit').status).toBe('rate_limit')
+    expect(canonicalizeCountryValue('Rate limit').status).toBe('rate_limit')
+    expect(canonicalizeCountryValue('Server error').status).toBe('server_error')
+  })
+})
+
+describe('ipregion normalize', () => {
+  it('нормализует сервис и группу', () => {
+    const row = normalizeIngestResult({
+      service: 'Maxmind.com',
+      ipv4: 'NL',
+      ipv6: 'N/A',
+    })
+    expect(row.serviceKey).toBe('maxmind.com')
+    expect(row.group).toBe('primary')
+    expect(row.status).toBe('ok')
+    expect(row.countryIpv4).toBe('NL')
+    expect(row.countryIpv6).toBeNull()
+  })
+
+  it('берёт IPv6 если IPv4 N/A', () => {
+    const row = normalizeIngestResult({
+      service: 'YouTube CDN',
+      group: 'cdn',
+      ipv4: 'N/A',
+      ipv6: 'US',
+    })
+    expect(row.status).toBe('ok')
+    expect(row.countryIpv6).toBe('US')
+    expect(row.group).toBe('cdn')
+  })
+
+  it('считает summary и partial', () => {
+    const { summary, runStatus } = summarizeResults([
+      { status: 'ok' },
+      { status: 'na' },
+      { status: 'denied' },
+    ])
+    expect(summary.total).toBe(3)
+    expect(summary.ok).toBe(1)
+    expect(summary.denied).toBe(1)
+    expect(runStatus).toBe('partial')
+  })
+
+  it('угадывает группу по имени', () => {
+    expect(inferIpregionGroup('cloudflare.com')).toBe('primary')
+    expect(inferIpregionGroup('Netflix')).toBe('custom')
+    expect(inferIpregionGroup('YouTube CDN')).toBe('cdn')
+  })
+})

apps/api/src/services/ipregion/normalize.ts

@@ -0,0 +1,52 @@
+import {
+  canonicalizeCountryValue,
+  emptyIpregionSummary,
+  inferIpregionGroup,
+  type IpregionGroup,
+  type IpregionIngestResult,
+  type IpregionRunStatus,
+  type IpregionStatus,
+  type IpregionSummary,
+} from '@cfdm/shared/contracts/ipregion'
+
+export type NormalizedIpregionResult = {
+  serviceKey: string
+  serviceLabel: string
+  group: IpregionGroup
+  countryIpv4: string | null
+  countryIpv6: string | null
+  status: IpregionStatus
+}
+
+export function normalizeIngestResult(item: IpregionIngestResult): NormalizedIpregionResult {
+  const serviceLabel = item.service.trim()
+  const serviceKey = serviceLabel.toLowerCase()
+  const ipv4 = canonicalizeCountryValue(item.ipv4)
+  const ipv6 = canonicalizeCountryValue(item.ipv6)
+  const status = ipv4.status !== 'na' ? ipv4.status : ipv6.status
+
+  return {
+    serviceKey,
+    serviceLabel,
+    group: item.group ?? inferIpregionGroup(serviceKey),
+    countryIpv4: ipv4.country,
+    countryIpv6: ipv6.country,
+    status,
+  }
+}
+
+export function summarizeResults(results: { status: IpregionStatus }[]): {
+  summary: IpregionSummary
+  runStatus: IpregionRunStatus
+} {
+  const summary = emptyIpregionSummary()
+  summary.total = results.length
+  for (const row of results) {
+    summary[row.status] += 1
+  }
+  const runStatus: IpregionRunStatus =
+    summary.denied > 0 || summary.rate_limit > 0 || summary.server_error > 0
+      ? 'partial'
+      : 'complete'
+  return { summary, runStatus }
+}