# Rebecca-node mirror for servers inside Iran

`raw.githubusercontent.com`, `api.github.com` and the old `ifconfig.io` probe are
unreachable from most Iranian servers, so the upstream installer cannot be run
as published. This mirror serves a patched copy of it plus every file the
installer needs, all from one host that the target server can reach.

## Install (the only command a client needs)

```bash
curl -fsSL https://git.nimbaha.org/rebecca/rebecca-node-binary.sh | sudo bash -s -- install
```

Useful variations:

```bash
# pick the binary (systemd) mode and a node name without prompts
curl -fsSL https://git.nimbaha.org/rebecca/rebecca-node-binary.sh \
  | sudo bash -s -- install --binary --name <node-name> --version latest

# nothing is written to disk before the bundle is pasted; --help lists everything
curl -fsSL https://git.nimbaha.org/rebecca/rebecca-node-binary.sh | sudo bash -s -- help
```

## What the patch changes

| Upstream | Here |
| --- | --- |
| `raw.githubusercontent.com/.../scripts/rebecca` | `https://git.nimbaha.org/rebecca/scripts/rebecca` |
| `api.github.com/repos/rebeccapanel/Rebecca-node/releases/latest` | `.../rebecca/api/repos/rebeccapanel/Rebecca-node/releases/latest` |
| `github.com/XTLS/Xray-core/releases/...` | `.../rebecca/xray/<tag>/Xray-linux-<arch>.zip` |
| `github.com/mikefarah/yq/releases/latest/download` | `.../rebecca/bin` |
| `curl -s -4 ifconfig.io` for `NODE_IP` | `ip -4 route get 1.1.1.1` (no network round trip) |
| `install_package` gives up when the archive is blocked | retried once through the Iranian apt/yum mirror, then restored |

The `ifconfig.io` patch matters as much as the URL ones: the call sat under
`set -e`, so a timeout killed the installer before it installed anything.

The package-manager retry is a wrapper around the original function:

1. upstream `install_package` runs unchanged;
2. only if it fails, `/usr/local/bin/ir-mirror-rebecca.inc.sh` (inlined into the
   script) rewrites the sources to `mirror.arvancloud.ir`;
3. `PKG_MANAGER` is cleared so the retry refreshes the index against the mirror;
4. a trap restores the original sources when the script exits, however it exits.

## Layout

```
rebecca-node-binary.sh                     the installer (hardlink of scripts/rebecca/)
scripts/rebecca/rebecca-node-binary.sh     same file — what self-update fetches
scripts/rebecca/install_latest_xray.sh     Xray installer, patched the same way
bin/rebecca-node-<tag>-linux-amd64|arm64   node binaries + .sha256
bin/yq_linux_*                             yq, hardlinked from the marzban mirror
xray/<tag>/Xray-linux-64|arm64-v8a.zip     pinned Xray core
api/repos/rebeccapanel/Rebecca-node/releases/latest
api/repos/rebeccapanel/Rebecca-node/releases/tags/<tag>
```

The two JSON files keep the upstream shape with only the amd64/arm64 asset URLs
rewritten, so the installer's own parsing is untouched.

## Refreshing

```bash
/usr/local/bin/sync-rebecca.sh     # fetch, patch, download, verify
/usr/local/bin/verify-rebecca.sh   # read-only integrity checks, 59 of them
```

`/etc/cron.d/rebecca-sync` runs the sync every Monday at 04:40, after marzban
(04:00) and pgnode (04:20). Logs: `/var/log/sync-rebecca.log`.

The sync always starts from the pristine upstream copy it just downloaded in
`/var/lib/rebecca-orig`, never from its own output, so re-running is safe. If
the patcher cannot find an anchor after an upstream change it restores
`/var/lib/rebecca-lastgood` and exits non-zero instead of publishing a
half-patched script.

Binaries from older releases and older Xray tags are pruned on every run.

## Verifying the install without touching a live node

The installer is interactive only for the bundle and the ports, so it can be
run end to end in a throwaway mount namespace:

```bash
unshare -m --propagation private bash -c '
  mount -t tmpfs none /opt
  mount -t tmpfs none /usr/local/bin
  mount -t tmpfs none /etc/systemd/system
  mount -t tmpfs none /var/lib/rebecca
  # stub systemctl/apt-get, set XRAY_CORE_VERSION, then:
  bash /path/to/rebecca-node-binary.sh install --binary --name test --version latest
'
```

Nothing outside the namespace is touched. Last run: exit 0, script, binary and
Xray core all fetched from this mirror, `NODE_IP` resolved locally.