Random I1 and MTU on install

I1 becomes a DNS query to a random popular domain (A/AAAA) instead of the
shared icloud.com response every key carried. The format sticks to tags both
the kernel module and amneziawg-go accept and is checked before awg1.conf is
written: a bad I1 fails the whole awg-quick up. With KEEP_DATA=y the old I1
is kept, or generated if missing — the server never checks it, old keys keep
their own.

MTU is picked from 1320–1376 (AWG_MTU overrides) and kept on reinstall.
awg-ctrl now reads MTU from awg1.conf for vpn:// keys instead of a constant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bNGYiDst62wH3ZGTRPFLJ

internal/ctrl/awg.go

@@ -344,8 +344,10 @@ func (s *Server) syncPeers() error {
 // vpn:// собирались бы на старых параметрах — например, на 2.0 уже после перехода на 3.1.
 func (s *Server) reloadAwgParams() string {
 	p := ReadParams(s.confPath(), func(m string) { s.log.Warn(m) })
+	mtu := ReadMTU(s.confPath())
 	s.cfgMu.Lock()
 	s.c.Params = p
+	s.c.MTU = mtu
 	s.c.Gen = p.Gen()
 	s.c.Keepalive = keepaliveByGen[s.c.Gen]
 	g := s.c.Gen

internal/ctrl/params.go

@@ -70,6 +70,28 @@ var AWG31Defaults = [][2]string{
 	{"MaxHandshakeAttempts", "15-20"},
 }
 
+// DefaultMTU — MTU установок до рандомизации; запасное, если в awg1.conf его нет или оно странное.
+const DefaultMTU = 1376
+
+// ReadMTU читает MTU из [Interface] awg1.conf: install.sh выбирает его случайно, у каждого
+// сервера своё, и клиенты получают его в vpn:// ключе.
+func ReadMTU(confFile string) int {
+	raw, err := os.ReadFile(confFile)
+	if err != nil {
+		return DefaultMTU
+	}
+	iface := pPeerSplit.Split(string(raw), 2)[0]
+	m := regexp.MustCompile(`(?m)^\s*MTU\s*=\s*(\d+)`).FindStringSubmatch(iface)
+	if m == nil {
+		return DefaultMTU
+	}
+	n, _ := strconv.Atoi(m[1])
+	if n < 1280 || n > 1500 {
+		return DefaultMTU
+	}
+	return n
+}
+
 // При заданном HeaderProtectionKey ни один из S1–S4 не может быть меньше 12.
 const minSForHeaderProtection = 12
 

internal/ctrl/server.go

@@ -150,7 +150,7 @@ func New() (*Server, error) {
 	module, tools := readVersions()
 	s.c = Config{
 		ServerIP: ip, ServerPort: sp, ServerName: name,
-		DNS1: "1.1.1.1", DNS2: "1.0.0.1", MTU: 1376, Subnet: "10.9",
+		DNS1: "1.1.1.1", DNS2: "1.0.0.1", MTU: ReadMTU(s.confPath()), Subnet: "10.9",
 		Keepalive: keepaliveByGen[gen], Params: params, Gen: gen,
 		AwgModule: module, AwgTools: tools,
 	}