probe

CHANGELOG.md

@@ -2,6 +2,76 @@
 
 User-facing Xrayebator changes. The server manager and Electron application are published from the canonical `howdeploy/Xrayebator` repository.
 
+## [0.6.5] - UNRELEASED (beta)
+
+Multi-protocol stage: Xray Reality is joined by Hysteria 2 (UDP/QUIC) and AmneziaWG 3.1
+(system VPN), a neutral backend registry with per-profile grants and lifecycle, a
+HAPP client-routing generator with split routing, softer SNI defaults, a graceful
+`http_tls` degradation path for hosters that filter port 80, and a wave of GUI feedback
+polish. **0.6.5 is in testing — if you need a proven build, stay on 0.6.0.**
+
+### Added
+
+- **Hysteria 2 backend** (multi-protocol slices 2–3): install/uninstall/status via the
+  registry, a dedicated `hysteria` system user with its own `hysteria-server.service`
+  (CAP_NET_BIND_SERVICE), QUIC buffer sysctls, per-profile grants (`hysteria2-grant`)
+  with passwords stored in the profile JSON, server config regenerated from profiles
+  with rollback, adaptive TLS (Let's Encrypt cert copied with a renewal deploy-hook,
+  or self-signed with `insecure=1` client links), and `hysteria2://` lines appended to
+  both subscription bodies behind a kill switch.
+- **AmneziaWG 3.1 backend** (slices 4–5 + 3.1): kernel module via DKMS (amnezia PPA
+  with a manual source-build fallback), `awg0` interface with junk params matching the
+  official Amnezia dialect, per-profile peers with keypair + preshared key, `awg0.conf`
+  regenerated from profiles, client `.conf` and `awg-conf` JSON for the GUI, AWG 3.1
+  format on by default (`HeaderProtectionKey`, `RandomTrailers`, `S1`–`S4`) with an
+  `awg-31` toggle and explicit re-download warnings, and the GUI delivering keys in the
+  app-native `vpn://` shape for AmneziaVPN.
+- **Multi-protocol GUI**: a "multi-protocol backends" panel in Server settings with
+  official Hysteria/Amnezia logos, backend profile cards alongside VLESS cards
+  (create flow with an explicit protocol choice — a new profile receives keys only
+  from the chosen backend), per-backend QR (including "QR · AmneziaVPN"), expiry,
+  revoke and delete with immediate backend-key revocation on profile deletion.
+- **HAPP client routing** (`bypass` CLI + generator): managed HAPP profile can carry
+  split routing from bypass groups, with placeholders (`{{GEOIP_URL}}`, `{{GEOSITE_URL}}`,
+  `{{LAST_UPDATED}}`) resolved per subscriber — geo databases are downloaded through the
+  subscription itself.
+- **quickstart `http_tls` graceful degradation**: when Let's Encrypt cannot validate
+  http-01 for the IP (`Connection reset by peer` — the hoster filters port 80), the
+  deploy no longer dead-ends: markers switch to `http_tls`, the subscription stays
+  loopback-only (there is no public subscription URL at all — the GUI loads keys over
+  SSH from `127.0.0.1:8080`), a self-signed certificate is generated for future backends,
+  and the result JSON carries `degraded:true` / `tls_mode:"http_tls"` / `certbot_reason`.
+  Re-running quickstart after the hoster unblocks port 80 restores HTTPS.
+- SNI candidates updated from the 03.09.2026 reachability measurements; the default SNI
+  for new profiles is `www.cloudflare.com`.
+- Server country in key names: the HAPP profile fragments are labelled with a country
+  flag and name (`🇫🇮 Finland · happ-...`) resolved from the server IP geo databases.
+- `validation/` grew from 28 to 34 scripts: backend registry, Hysteria 2 lifecycle,
+  AmneziaWG junk/renderers/lifecycle, HAPP client routing, legacy profile port sync,
+  quickstart `http_tls` fallback, apt-lock race, profile revoke/expire CLI.
+- Branch choice for server updates: the "Update Xrayebator" button became a menu —
+  "Auto — as pinned on the server" (previous behavior), "main — latest stable release",
+  "dev — every feature first" (may be unstable): a server can be moved to the dev
+  manager before the merge without polluting main; switching back is an update from main.
+
+### Fixed
+
+- `revoke --full` crashed on single-route profiles (invalid jq path).
+- `xrayebator profile-delete` printed colored status lines into stdout JSON; the CLI
+  path is JSON-clean now and backend grants are revoked in the same command (no
+  orphaned AWG peers or Hysteria passwords).
+- Backend keys are granted only for the explicitly chosen protocol — creation no longer
+  issues keys from every installed backend.
+- AWG ports moved out of the ephemeral range and ufw reloads are avoided during batch
+  firewall updates.
+- Dead duplicate function definitions in the single-file manager removed (a shadowed
+  validator whose body would have clobbered subscription markers if ever called).
+- The GUI no longer shows a dead `https://IP:8443` subscription URL on degraded
+  (`http_tls`) servers: no public link is displayed or saved at all, keys are fetched
+  over SSH, and the server is stored as "partially configured" with a degraded badge.
+- Backend key creation/revoke/expiry dialogs match the VLESS card semantics
+  (danger-soft confirmations, device notes, expiry presets).
+
 ## [0.6.0] - 2026-10-01
 
 Access control in the panel: subscription revocation (link-only or full), profile expiry

README.md

@@ -6,7 +6,8 @@
 
 <p>
 <strong>inbounds</strong> · <strong>profiles</strong> · <strong>subscription</strong> ·
-<strong>bypass</strong> · <strong>cascade</strong>
+<strong>bypass</strong> · <strong>cascade</strong> · <strong>hysteria2</strong> ·
+<strong>amneziawg</strong>
 </p>
 
 <p>
@@ -28,8 +29,10 @@
 Xrayebator installs Xray-core, brings up Reality inbounds on random ports, and provisions a standard
 schema-v3 HAPP profile of seven routes for a new setup. Existing seven-route profiles can be reused only
 when they have enough live routes, so inspect the profile JSON when debugging labels or schema. The client
-receives the routes as a single HTTPS subscription link. Current server line — 3.0; the optional Electron
-desktop app is versioned separately.
+receives the routes as a single HTTPS subscription link. As of the multi-protocol stage, optional
+Hysteria 2 (fast UDP) and AmneziaWG 2.0/3.1 (system VPN) backends can be installed on the same VPS from
+menu items 11–13, with per-profile grants wired into the shared revoke/expire lifecycle. Current server
+line — 3.0; the optional Electron desktop app is versioned separately.
 </p>
 
 </div>

README.ru.md

@@ -6,7 +6,8 @@
 
 <p>
 <strong>инбаунды</strong> · <strong>профили</strong> · <strong>подписка</strong> ·
-<strong>bypass</strong> · <strong>каскад</strong>
+<strong>bypass</strong> · <strong>каскад</strong> · <strong>hysteria2</strong> ·
+<strong>amneziawg</strong>
 </p>
 
 <p>
@@ -28,7 +29,10 @@
 Xrayebator ставит Xray-core, поднимает Reality-инбаунды на случайных портах и для новой установки
 создаёт стандартный schema-v3 HAPP-профиль из семи маршрутов. Существующий семимаршрутный профиль
 может быть переиспользован при наличии живых маршрутов, поэтому при отладке label/schema проверяйте
-profile JSON. Клиент получает маршруты одной HTTPS-ссылкой подписки. Актуальная серверная линия — 3.0;
+profile JSON. Клиент получает маршруты одной HTTPS-ссылкой подписки. Начиная с мультипротокольного
+этапа, на тот же VPS опционально ставятся бэкенды Hysteria 2 (быстрый UDP) и AmneziaWG 2.0/3.1
+(системный VPN) — пункты меню 11–13, гранты per-profile включены в общий жизненный цикл
+revoke/expire. Актуальная серверная линия — 3.0;
 опциональное Electron-десктоп-приложение имеет отдельную версию.
 </p>
 

README.zh-CN.md

@@ -6,7 +6,8 @@
 
 <p>
 <strong>入站</strong> · <strong>配置档</strong> · <strong>订阅</strong> ·
-<strong>分流</strong> · <strong>级联</strong>
+<strong>分流</strong> · <strong>级联</strong> · <strong>hysteria2</strong> ·
+<strong>amneziawg</strong>
 </p>
 
 <p>
@@ -27,7 +28,9 @@
 <strong>一个 bash 脚本，把干净的 VPS 变成私人 VLESS Reality 服务器。</strong><br>
 Xrayebator 安装 Xray-core，在随机端口上建立 Reality 入站，并为新安装创建包含七条线路的标准
 schema-v3 HAPP 配置档。已有七线路配置档在满足存活线路数量时可能被复用，因此排查 label 或 schema
-时请检查配置档 JSON。客户端通过一条 HTTPS 订阅链接获取线路。当前服务器版本线为 3.0；可选
+时请检查配置档 JSON。客户端通过一条 HTTPS 订阅链接获取线路。自多协议阶段起，同一台 VPS 可选装
+Hysteria 2（高速 UDP）与 AmneziaWG 2.0/3.1（系统级 VPN）后端——菜单项 11–13，每配置档授权纳入统一的
+revoke/expire 生命周期。当前服务器版本线为 3.0；可选
 Electron 桌面应用单独版本化。
 </p>
 

docs/architecture.md

@@ -52,7 +52,7 @@ configuration and systemd unit form the HAPP subscription path. The active deskt
 
 /usr/local/etc/xray/
 ├── config.json                   # inbounds, outbounds, routing and DNS
-├── profiles/<name>.json          # profile metadata, subscription token, expiry (.expire)
+├── profiles/<name>.json          # profile metadata, subscription token, expiry (.expire), backend grants (.backends)
 ├── upstreams/cascade.json        # cascade upstream parameters
 ├── backups/                      # config backups made before runtime mutations
 ├── .private_key / .public_key    # Reality keys
@@ -62,10 +62,18 @@ configuration and systemd unit form the HAPP subscription path. The active deskt
 ├── .current_branch               # manager branch used by lifecycle updates
 └── migration markers             # records of completed one-time migrations
 
+/usr/local/etc/xrayebator/         # multi-protocol backend root (neutral, Xray paths untouched)
+├── backends.json                  # backend registry: installed/version/port/flags (644, no secrets)
+└── backends/
+    ├── hysteria2/                 # server.yaml (regenerated from profiles), certs, placeholder credential
+    └── awg/                       # awg0.conf (0600), server-params.json (0600)
+
 /usr/local/share/xray/             # geoip.dat and geosite.dat
 /var/log/xray/                     # runtime log directory written by the Xray service
 /etc/systemd/system/xray.service.d/security.conf
 /etc/systemd/system/xrayebator-sub.service
+/etc/systemd/system/hysteria-server.service   # Hysteria 2 backend (optional)
+/etc/systemd/system/awg-quick@awg0.service    # AmneziaWG backend (optional, from amneziawg-tools)
 /etc/nginx/sites-available/xrayebator-sub
 ```
 
@@ -102,13 +110,17 @@ The base is built from the saved subscription markers:
 ```text
 https://<domain>/sub/<32-hex-token>       # public TLS on 443
 https://<domain>:8443/sub/<32-hex-token>  # public TLS on another port
+http://<IP>:8080/sub/<token>              # http_tls fallback (LE could not validate http-01)
 http://127.0.0.1:8080/sub/<token>         # local-only fallback
 ```
 
 The interactive HAPP setup can select the public port and `_subscription_base_url` preserves that
 choice. The non-interactive `quickstart --email <address>` and `quickstart --without-email` IP-TLS paths
 provision nginx, certificate and markers on `8443`, then emit JSON containing `subscription_url` for that
-endpoint. Without an email, Certbot is explicitly told to register without an ACME contact; renewal
+endpoint. When Let's Encrypt cannot validate http-01 (the hoster filters port 80 for foreign sources),
+quickstart degrades to `http_tls`: the markers switch to that mode, the subscription is published over
+HTTP from the loopback handler and the JSON carries `degraded:true`; rerunning the deploy after port 80
+is unblocked restores ip_tls. Without an email, Certbot is explicitly told to register without an ACME contact; renewal
 notices and email-based recovery are unavailable. The token is stored in the profile as `sub_token`;
 revoke rotates it and invalidates the previous URL, while a full revoke (`profile-revoke --full`) also
 changes the uuid in every inbound of the profile so already-downloaded configurations stop connecting.
@@ -132,7 +144,32 @@ or quickstart when the required routes are absent. A profile with no live inboun
 
 The handler also serves the token-protected `geoip.dat` and `geosite.dat` resources required by the
 managed HAPP routing profile. HAPP receives its routing metadata, while v2rayNG and v2rayN receive
-the compatible VLESS body without HAPP-only metadata.
+the compatible VLESS body without HAPP-only metadata. When the Hysteria 2 backend is installed and
+the profile has a grant, the handler additionally appends one `hysteria2://` line to both the HAPP
+and the generic subscription bodies, gated by the registry flag `sub_body`; expired or disabled
+profiles never get the line.
+
+## Multi-protocol backends
+
+Beyond Xray, the manager can install additional transports on the same VPS. All backend state lives
+in the neutral root `/usr/local/etc/xrayebator/` (registry `backends.json` plus per-backend
+directories); the Xray state paths are untouched. Per-profile backend credentials live in the
+profile's additive `.backends` object, which makes the profile JSON the single source of truth:
+server-side configs (`backends/hysteria2/server.yaml`, `backends/awg/awg0.conf`) are always
+regenerated from profiles, and profile lifecycle events (create, delete, revoke, expire, restore)
+propagate through `_backend_apply_profile_lifecycle` to every installed backend.
+
+- **Hysteria 2** — fast UDP transport. Own systemd unit `hysteria-server.service` running as the
+  dedicated `hysteria` user with `CAP_NET_BIND_SERVICE`; UDP 443 by default; adaptive TLS (the
+  subscription Let's Encrypt certificate plus a renewal deploy-hook, or a self-signed certificate);
+  `auth: userpass` with one credential per profile and a placeholder user while the map would
+  otherwise be empty (Hysteria rejects an empty map).
+- **AmneziaWG 2.0** — system VPN. Kernel module via DKMS (PPA `amnezia/ppa` primary, source build
+  fallback), interface `awg0` through `awg-quick@awg0`, subnet `10.8.1.0/24`, per-profile peers
+  (keypair + preshared key + address), `ip_forward` and MASQUERADE on the default-route interface.
+  The distro unit reads `/etc/amnezia/amneziawg/awg0.conf`, which is a symlink to the managed file.
+- Both backends are optional, installed and removed from menu items `11`–`13` or the `hysteria2-*`
+  / `awg-*` CLI commands, and are never installed by default.
 
 ## Update paths