From dbc426b8610fd74e29eae06b2dbad461598ee04b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Wed, 1 Jul 2026 14:57:53 +0400
Subject: [PATCH] v5.0.66: utls + proxy CONNECT tunnel (DDoS-Guard bypass)

---
 TEST_STAND/buck0/main.tf                      |  2 +-
 .../internal/provider/provider.go             | 34 +++++++++++++++++++
 universal_rebuild/main.go                     |  2 +-
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/TEST_STAND/buck0/main.tf b/TEST_STAND/buck0/main.tf
index c04e818..d0a7838 100644
--- a/TEST_STAND/buck0/main.tf
+++ b/TEST_STAND/buck0/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     nubes = {
       source  = "terra.k8c.ru/nubes-test/nubes"
-      version = "5.0.65"
+      version = "5.0.66"
     }
   }
 }
diff --git a/universal_rebuild/internal/provider/provider.go b/universal_rebuild/internal/provider/provider.go
index 61c2da9..2c1942e 100644
--- a/universal_rebuild/internal/provider/provider.go
+++ b/universal_rebuild/internal/provider/provider.go
@@ -1,8 +1,10 @@
 package provider
 
 import (
+	"bufio"
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net"
 	"net/http"
 	"os"
@@ -130,7 +132,39 @@ func (p *NubesProvider) Configure(ctx context.Context, req provider.ConfigureReq
 	// utls: маскируем Go TLS под Firefox, чтобы пройти DDoS-Guard (JA3 fingerprint).
 	// Стандартный crypto/tls и Chrome блокируются на deck-api-*.ngcloud.ru.
 	transport.DialTLSContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		// Используем прокси если задан (HTTPS_PROXY) — без него API не доступен
 		dialer := &net.Dialer{Timeout: 30 * time.Second}
+		proxyFunc := transport.Proxy
+		target := addr
+		if proxyFunc != nil {
+			proxy, err := proxyFunc(nil)
+			if err == nil && proxy != nil {
+				conn, err := dialer.DialContext(ctx, "tcp", proxy.Host)
+				if err != nil {
+					return nil, err
+				}
+				// CONNECT tunnel
+				fmt.Fprintf(conn, "CONNECT %s HTTP/1.1\r\nHost: %s\r\n\r\n", target, target)
+				br := bufio.NewReader(conn)
+				resp, err := http.ReadResponse(br, nil)
+				if err != nil || resp.StatusCode != 200 {
+					conn.Close()
+					return nil, fmt.Errorf("proxy CONNECT failed: %v", err)
+				}
+				host, _, _ := net.SplitHostPort(target)
+				uconn := utls.UClient(conn, &utls.Config{
+					ServerName:         host,
+					InsecureSkipVerify: insecureSkipVerify,
+					MinVersion:         tls.VersionTLS12,
+				}, utls.HelloFirefox_120)
+				if err := uconn.HandshakeContext(ctx); err != nil {
+					conn.Close()
+					return nil, err
+				}
+				return uconn, nil
+			}
+		}
+		// Прямое соединение (без прокси)
 		conn, err := dialer.DialContext(ctx, network, addr)
 		if err != nil {
 			return nil, err
diff --git a/universal_rebuild/main.go b/universal_rebuild/main.go
index e12d79a..c30aa42 100644
--- a/universal_rebuild/main.go
+++ b/universal_rebuild/main.go
@@ -10,7 +10,7 @@ import (
 )
 
 var (
-	version string = "5.0.65"
+	version string = "5.0.66"
 )
 
 func main() {