PP-Proxy

Multi-hop SSH proxy manager with Web UI — SOCKS5 / SOCKS4 / HTTP, cross-platform, single binary.

中文说明 | Features | Quick Start | Build

---

Features

• Web UI — Modern dark-themed management interface with i18n (中文/English)
• Multi-hop SSH — Chain multiple servers: Local → Jump-A → Jump-B → Internet
• Multi-protocol — SOCKS5, SOCKS4, HTTP local proxy with optional authentication; SSH is native, subscription protocols (Shadowsocks/Trojan/VMess/VLESS/Hysteria2/AnyTLS) run through the embedded per-node sing-box engine
• Observable subscriptions — Import/refresh logs, node-name blacklist filtering, post-import rename
• LAN access — Toggle to expose proxy to local network
• Auto-start — System boot auto-launch (macOS LaunchAgent / Linux systemd / Windows Registry)
• Cross-platform — Single binary for macOS, Linux, Windows
• Import/Export — Encrypted (AES-256-GCM) or plain config backup
• Real-time stats — WebSocket traffic monitoring

Quick Start

Download the binary for your platform from Releases or build from source:

make build
./pp-ssh-proxy

Open http://localhost:8080, login with default password admin.

Change Password

Settings → Change Password, or delete ~/.pp-proxy/password to reset to admin.

Configure Browser

# Chrome
chrome --proxy-server="socks5://127.0.0.1:1080"

# Firefox
Settings → Network → SOCKS5: 127.0.0.1:1080

# Terminal
curl --socks5 127.0.0.1:1080 https://httpbin.org/ip

Build

# Dev
make dev

# Current platform
make build

# All platforms (macOS/Linux/Windows)
make release

Output: dist/pp-ssh-proxy-1.0.0-{os}-{arch}

The default Makefile and release workflow build with -tags with_utls,with_grpc,with_quic so VLESS Reality/uTLS, full V2Ray gRPC transport, and V2Ray QUIC transport are included. Shadowsocks, Trojan/VMess/VLESS TCP/WS/HTTP transports, Hysteria2, and AnyTLS do not require extra build tags in this embedded single-node mode. If you bypass Makefile, use:

go build -tags "with_utls,with_grpc,with_quic" -o pp-proxy .

Other sing-box with_* tags were checked and are intentionally not part of the default protocol-runtime set: with_ech and with_reality_server are deprecated build-breaking tags; with_clash_api, with_v2ray_api, with_acme, with_dhcp, with_ccm, with_ocm, and with_tailscale are service/API/TUN features outside app-owned single-outbound routing; with_naive_outbound, with_wireguard, and with_gvisor should only be enabled together with parser/model/engine support for those protocols.

Logs and live subscription smoke test

Runtime logs are written under ~/.pp-proxy/logs/:

• app.log — API/server lifecycle
• subscription.log — import/refresh/fetch/parse/filter/save details
• proxy.log — smart-route decisions and protocol-engine dials

Opt-in live diagnostics (do not run in CI unless you provide a subscription URL):

go run -tags "with_utls,with_grpc,with_quic" ./cmd/sub-smoke \
  -url "https://example.com/sub?clash=1" \
  -protocols vless,trojan,hysteria2,anytls \
  -per-protocol 1 \
  -timeout 20s \
  -concurrency 4

Architecture

Browser (Web UI) ←→ Go HTTP (:8080) ←→ SSH Chain ←→ Server(s) ←→ Internet
App ───→ SOCKS5/HTTP(:1080) ───┘

---

中文

PP-Proxy — 多级 SSH 代理管理器

基于 Web 的 SSH 代理管理工具，支持 SOCKS5/SOCKS4/HTTP 协议，多级中转，全平台单文件部署。

功能

• Web 界面 — 暗色主题，支持中英文切换
• 多级中转 — 链式 SSH 隧道：本地 → 跳板A → 跳板B → 互联网
• 多协议 — SOCKS5、SOCKS4、HTTP 本地代理，可选认证；SSH 原生执行，订阅协议（Shadowsocks/Trojan/VMess/VLESS/Hysteria2/AnyTLS）通过内嵌 sing-box 按单节点执行
• 订阅可观测 — 导入/刷新日志、节点名称黑名单过滤、导入后重命名
• 局域网共享 — 一键开启局域网访问
• 开机自启 — macOS LaunchAgent / Linux systemd / Windows 注册表
• 跨平台 — macOS、Linux、Windows 单文件二进制
• 配置备份 — 支持 AES-256-GCM 加密导出/导入
• 实时监控 — WebSocket 推送流量统计

快速开始

make build
./pp-ssh-proxy

浏览器打开 **http://localhost:8080**，默认密码 admin。

密码管理

• 修改密码：设置 → 修改密码
• 重置密码：删除 ~/.pp-proxy/password 文件后重启

浏览器配置

# Chrome
chrome --proxy-server="socks5://127.0.0.1:1080"

# Firefox: 设置 → 网络 → SOCKS5 代理: 127.0.0.1:1080

# 命令行测试
curl --socks5 127.0.0.1:1080 https://httpbin.org/ip

从源码构建

# 开发模式
make dev

# 当前平台
make build

# 全平台发布
make release
# 输出: dist/pp-ssh-proxy-1.0.0-{darwin,linux,windows}-{amd64,arm64}

默认 Makefile/Release 使用 -tags with_utls,with_grpc,with_quic，以包含 VLESS Reality/uTLS、完整 V2Ray gRPC 传输、V2Ray QUIC 传输。Shadowsocks、Trojan/VMess/VLESS 的 TCP/WS/HTTP 传输、Hysteria2、AnyTLS 在当前内嵌单节点模式下不需要额外 tag。手动构建时请使用：

go build -tags "with_utls,with_grpc,with_quic" -o pp-proxy .

已检查其它 sing-box with_* tag，默认协议运行时不会全部打开：with_ech、with_reality_server 是已废弃且会导致构建失败的 tag；with_clash_api、with_v2ray_api、with_acme、with_dhcp、with_ccm、with_ocm、with_tailscale 属于服务/API/TUN 能力，不属于当前应用自己决策后的单 outbound 执行；with_naive_outbound、with_wireguard、with_gvisor 需要等 NaiveProxy/WireGuard 的解析、模型和引擎映射一起实现后再打开。

日志与订阅实测

日志目录：~/.pp-proxy/logs/

• app.log：API/服务生命周期
• subscription.log：订阅拉取、解析、过滤、保存详情
• proxy.log：智能路由选择与协议拨号详情

可选真实订阅冒烟测试：

go run -tags "with_utls,with_grpc,with_quic" ./cmd/sub-smoke \
  -url "https://example.com/sub?clash=1" \
  -protocols vless,trojan,hysteria2,anytls \
  -per-protocol 1 \
  -timeout 20s \
  -concurrency 4

License

MIT