Prometheus on a node; panel under a URL prefix; open ports on migrate import

A panel without VPN (e.g. after the move) can use a Prometheus that lives on
a node, such as the one with history left on the old server (node #0). Both
directions go through the agent's WSS: the node's Prometheus scrapes
127.0.0.1:AGENT_METRICS_PORT/metrics, the agent checks its token and asks
core (metrics → metrics_res, the same exposition as /metrics, at most once
per 5 s per connection); the monitor tab reads it back through the agent,
which forwards only GET /-/ready and /api/v1/query[_range]. The panel finds
it by itself (local first, then the lowest-id node), and the install/remove
buttons work on a panel without VPN. `monitor install` on a node without its
own panel picks AGENT_METRICS_PORT, writes it to cli.env and restarts the
agent; on the old server it keeps the collected data.

The panel works behind nginx in a subfolder: relative asset and API paths,
relative directory redirects, and the client address from X-Forwarded-For /
X-Real-IP only from trusted proxies (loopback, TRUST_PROXY).

migrate import opens the moved SUB_PORT/NODE_PORT in UFW when it is active.

internal/cli/cli.go

@@ -184,6 +184,8 @@ func New() *CLI {
 				{"NODE_PORT", env("NODE_PORT", "")},
 				// IP ретрансляторов (старый сервер после переноса): им — доверие к заголовку PROXY.
 				{"RELAY_FROM", env("RELAY_FROM", "")},
+				// Reverse-proxy перед панелью (кроме loopback): от них — X-Forwarded-For / X-Real-IP.
+				{"TRUST_PROXY", env("TRUST_PROXY", "")},
 				// Когда панель приняла перенос: с этого момента считаются клиенты, узнавшие новый адрес.
 				{"MOVED_IN_AT", env("MOVED_IN_AT", "")},
 				// Вкладка «Перенос» пишет сюда порты, PANEL_MOVED и RELAY_FROM.
@@ -211,6 +213,8 @@ func New() *CLI {
 				{"CLI_ENV_FILE", cliEnv},
 				{"AWGCTRL_PORT", env("AWGCTRL_PORT", "3005")},
 				{"INTERNAL_AUTH_KEY_FILE", env("INTERNAL_AUTH_KEY_FILE", "/etc/amnezia/amneziawg/internal_auth_private.key")},
+				// Prometheus на ноде (`monitor install`): здесь он скрейпит метрики панели.
+				{"AGENT_METRICS_PORT", env("AGENT_METRICS_PORT", "")},
 			},
 			pidFile: "/tmp/awg-agent.pid", logFile: filepath.Join(c.logs, "awg-agent.log"),
 		},
@@ -249,6 +253,18 @@ func New() *CLI {
 	return c
 }
 
+// setSvcEnv — значение, записанное в cli.env уже после запуска CLI, для следующего start.
+func (c *CLI) setSvcEnv(name, key, value string) {
+	s := c.svc[name]
+	for i := range s.env {
+		if s.env[i][0] == key {
+			s.env[i][1] = value
+			return
+		}
+	}
+	s.env = append(s.env, [2]string{key, value})
+}
+
 func (c *CLI) panelMoved() bool { return strings.ToLower(os.Getenv("PANEL_MOVED")) == "on" }
 
 func without(s []string, v string) []string {