From 8e3e924952efb658926c27359ed6a11f7f0477a4 Mon Sep 17 00:00:00 2001
From: Crimson <admin@flamy.studio>
Date: Tue, 12 May 2026 20:46:57 +0500
Subject: [PATCH] =?UTF-8?q?=D0=94=D0=BE=D0=BA=D1=83=D0=BC=D0=B5=D0=BD?=
 =?UTF-8?q?=D1=82=D0=B0=D1=86=D0=B8=D1=8F=20=D0=B8=20postinst=20UX:=20?=
 =?UTF-8?q?=D0=B1=D0=B5=D0=B7=D0=BE=D0=BF=D0=B0=D1=81=D0=BD=D0=B0=D1=8F=20?=
 =?UTF-8?q?=D0=BF=D1=80=D0=BE=D0=B2=D0=B5=D1=80=D0=BA=D0=B0=20checksum=20?=
 =?UTF-8?q?=D0=B8=20preflight-first?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md            |  2 +-
 docs/INSTALLATION.md | 23 ++++++++++++++++++++++-
 tools/README.md      |  4 ++--
 tools/build.sh       |  5 ++++-
 4 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 5b38b15..a414467 100644
--- a/README.md
+++ b/README.md
@@ -159,7 +159,7 @@ Security note:
 cd awg2_harness
 ./tools/build.sh --prepare-build-env --bootstrap-rust --yes
 ./tools/build.sh --package --version 0.1.6
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
 dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ```
diff --git a/docs/INSTALLATION.md b/docs/INSTALLATION.md
index d4a9d7b..664c098 100644
--- a/docs/INSTALLATION.md
+++ b/docs/INSTALLATION.md
@@ -40,7 +40,7 @@ cargo test --locked --workspace --release --manifest-path Cargo.toml
 
 ```bash
 ./tools/build.sh --package --version 0.1.6
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
 dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ```
@@ -176,6 +176,27 @@ ports={"53/tcp":null,"53/udp":null}
 
 Это означает, что DNS не опубликован на публичном host-интерфейсе и остаётся доступным только через VPN/Docker path.
 
+Negative-check публичного DNS:
+
+```bash
+nslookup example.com <server-public-ip>
+```
+
+Ожидаемое поведение: публичный DNS-запрос **не должен успешно резолвиться**. Типичные безопасные варианты ответа: `connection refused`, `timeout` или `no servers could be reached`.
+
+Optional deep-check DNS path (если нужна углублённая проверка):
+
+```bash
+apt install -y dnsutils
+
+DNS_PID="$(docker inspect -f '{{.State.Pid}}' amnezia-dns)"
+AWG_PID="$(docker inspect -f '{{.State.Pid}}' amnezia-awg2)"
+
+nsenter -t "$DNS_PID" -n ss -lntup
+nsenter -t "$AWG_PID" -n ip route
+nsenter -t "$AWG_PID" -n dig @172.29.172.254 example.com A +short
+```
+
 ## C. Transfer artifacts
 
 Ниже два production-сценария установки.
diff --git a/tools/README.md b/tools/README.md
index 5a0515f..b543e3c 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -25,7 +25,7 @@ cd awg2_harness
 chmod +x tools/build.sh
 ./tools/build.sh --prepare-build-env --bootstrap-rust --yes
 ./tools/build.sh --package --version 0.1.6
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
 dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ```
@@ -41,7 +41,7 @@ dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
 ## Проверка пакета перед переносом
 
 ```bash
-sha256sum -c dist/SHA256SUMS
+(cd dist && sha256sum -c SHA256SUMS)
 dpkg-deb -I dist/awg2-harness_<version>_amd64.deb
 dpkg-deb -c dist/awg2-harness_<version>_amd64.deb | sort
 ```
diff --git a/tools/build.sh b/tools/build.sh
index e5491a3..ea798b8 100644
--- a/tools/build.sh
+++ b/tools/build.sh
@@ -376,8 +376,11 @@ echo "Create /etc/awg2-harness/config.toml manually before enabling services:"
 echo "  install -d -m 0755 /etc/awg2-harness"
 echo "  cp /usr/share/doc/awg2-harness/repo/config.example.toml /etc/awg2-harness/config.toml"
 echo "  nano /etc/awg2-harness/config.toml"
-echo "Then validate and enable services:"
+echo "Then run preflight before enabling services:"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-config"
+echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-runtime"
+echo "  awg2-harness --config /etc/awg2-harness/config.toml status"
+echo "Enable services only after SSH, Amnezia port and peer CIDR are verified."
 echo "  systemctl enable --now awg2-harness.service awg2-reboot-scheduler.service"
 
 exit 0