feat(ru): full Russia/offline support (#RF)

- Add lib/download_helper.sh: proxy detection, GitHub mirrors, offline cache, tarball fallback
- Rewrite install_nfqws.sh: offline bundle support, bol-van/zapret via git clone + tarball + mirror fallback
- Rewrite sync_from_upstream.sh: proxy aware, --offline flag, graceful degradation
- Add prepare_offline_bundle.sh: create tar.gz with sources + lists + fake bins on machine WITH internet
- Add .env.example: GITHUB_PROXY, HTTPS_PROXY configuration
- Update install.sh: check GitHub reachability, suggest proxy/offline, --offline flag
- Update README: Russia section at top, Offline section, VPN/proxy examples, .env guide

install_nfqws.sh

@@ -1,16 +1,21 @@
 #!/bin/bash
+# install_nfqws.sh - Build nfqws with fallback for РФ (GitHub blocked)
 set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BIN_DIR="$SCRIPT_DIR/bin"
 BUILD_DIR="/tmp/zapret-build-$$"
 
+source "$SCRIPT_DIR/lib/download_helper.sh"
+
 echo "=============================================="
-echo "  Zapret Builder for Linux"
-echo "  Target: nfqws binary"
+echo "  Zapret Builder for Linux (v2 — РФ-ready)"
 echo "=============================================="
 echo ""
 
+# Load proxy
+load_proxy
+
 if [ -f /etc/os-release ]; then
     . /etc/os-release
     DISTRO="$ID"
@@ -19,8 +24,17 @@ else
 fi
 
 echo "[*] Detected distro: $DISTRO"
-echo "[*] Installing build dependencies..."
 
+# Check if offline bundle exists (pre-downloaded)
+OFFLINE_SOURCES=""
+if [[ -d "$SCRIPT_DIR/.bundle/sources/zapret" ]]; then
+    OFFLINE_SOURCES="$SCRIPT_DIR/.bundle/sources/zapret"
+    echo "[OK] Using offline source: $OFFLINE_SOURCES"
+else
+    echo "[*] No offline bundle found. Will try to download..."
+fi
+
+echo "[*] Installing build dependencies..."
 install_deps() {
     case "$DISTRO" in
         ubuntu|debian|linuxmint|pop|zorin|kubuntu|xubuntu|lubuntu)
@@ -43,38 +57,50 @@ install_deps() {
             sudo apk add --no-cache git make gcc curl iptables nftables libnetfilter_queue-dev libcap-dev linux-headers
             ;;
         *)
-            echo "[!] Unknown/unsupported distro: $DISTRO"
-            echo "    Required packages: git, make, gcc, libnetfilter_queue (dev), curl"
+            echo "[!] Unknown distro: $DISTRO"
+            echo "    Required: git, make, gcc, curl, iptables/nftables, libnetfilter_queue"
             read -rp "Continue anyway? [y/N]: " ans
-            if [[ "$ans" != [yY]* ]]; then
-                exit 1
-            fi
+            [[ "$ans" == [yY]* ]] || exit 1
             ;;
     esac
 }
 install_deps
 
 echo ""
-echo "[*] Cloning bol-van/zapret..."
+echo "[*] Preparing zapret sources..."
 mkdir -p "$BUILD_DIR"
-cd "$BUILD_DIR"
 
-if ! git clone --depth=1 https://github.com/bol-van/zapret.git; then
-    echo "[!] Failed to clone repository. Check your internet connection."
-    exit 1
+if [[ -n "$OFFLINE_SOURCES" ]]; then
+    echo "  Copying offline sources..."
+    cp -r "$OFFLINE_SOURCES" "$BUILD_DIR/zapret"
+else
+    echo "[*] Downloading bol-van/zapret (with fallback)..."
+    if ! clone_repo_fallback "bol-van/zapret" "master" "$BUILD_DIR/zapret"; then
+        echo ""
+        echo "[CRITICAL] Failed to download zapret sources."
+        echo ""
+        echo "Solutions:"
+        echo "  1. Set proxy:  export HTTPS_PROXY=socks5://127.0.0.1:1080"
+        echo "  2. Use VPN and re-run"
+        echo "  3. Pre-download with prepare_offline_bundle.sh (on machine WITH internet)"
+        echo "     tar -xzf bundle.tar.gz"
+        echo "     mv bundle/* /opt/zapret"
+        echo "  4. Manual: git clone https://github.com/bol-van/zapret.git"
+        echo ""
+        exit 1
+    fi
 fi
 
-cd zapret
+cd "$BUILD_DIR/zapret"
 
 echo "[*] Building nfqws..."
 if ! make -C nfq; then
     echo "[!] Build failed!"
-    echo "    Check that you have all dependencies installed."
     exit 1
 fi
 
 if [ ! -f "$BUILD_DIR/zapret/nfq/nfqws" ]; then
-    echo "[!] Build failed: nfqws not found after compilation"
+    echo "[!] nfqws binary not found after build"
     exit 1
 fi
 
@@ -88,31 +114,34 @@ FAKE_BIN_URL="https://github.com/bol-van/zapret/raw/master/files/fake"
 
 for f in quic_initial_www_google_com.bin quic_initial_dbankcloud_ru.bin tls_clienthello_www_google_com.bin tls_clienthello_4pda_to.bin tls_clienthello_max_ru.bin stun.bin; do
     if curl -sfL "$FAKE_BIN_URL/$f" -o "$BIN_DIR/$f" 2>/dev/null; then
-        echo "    [OK] $f"
+        echo "  [OK] $f"
     else
-        echo "    [SKIP] $f (will try to find local alternatives)"
+        echo "  [SKIP] $f (will try local/offline)"
     fi
 done
 
+# Try offline bundle fallback for fake bins
+if [[ -d "$SCRIPT_DIR/.bundle" ]]; then
+    for f in quic_initial_www_google_com.bin quic_initial_dbankcloud_ru.bin tls_clienthello_www_google_com.bin tls_clienthello_4pda_to.bin tls_clienthello_max_ru.bin stun.bin; do
+        if [[ -f "$SCRIPT_DIR/.bundle/$f" ]] && [[ ! -f "$BIN_DIR/$f" ]]; then
+            cp "$SCRIPT_DIR/.bundle/$f" "$BIN_DIR/$f"
+            echo "  [OK] $f (from offline bundle)"
+        fi
+    done
+fi
+
 echo ""
-echo "[*] Setting capabilities (optional, allows running without root)..."
+echo "[*] Setting capabilities..."
 if command -v setcap >/dev/null 2>&1; then
     sudo setcap cap_net_admin,cap_net_raw+eip "$BIN_DIR/nfqws" 2>/dev/null || true
-    echo "    [OK] cap_net_admin,cap_net_raw set on nfqws"
+    echo "  [OK] cap_net_admin,cap_net_raw set"
 fi
 
 echo ""
 echo "[*] Cleanup..."
-cd "$SCRIPT_DIR"
 rm -rf "$BUILD_DIR"
 
 echo ""
 echo "=============================================="
-echo "  Build complete!"
-echo "  Binary: $BIN_DIR/nfqws"
+echo "  Build complete! Binary: $BIN_DIR/nfqws"
 echo "=============================================="
-echo ""
-echo "Next steps:"
-echo "  1. Run './service.sh' to manage strategies"
-echo "  2. Or run any './general*.sh' script directly"
-echo ""