Before: every 6s UI refresh pulled up to 8MB of raw /proc/net/nf_conntrack
over SSH and detection only ran while someone watched the page.
Now: a background monitor thread (60s) runs one cheap SSH roundtrip per
AWG instance - an awk aggregation inside the container that transfers only
the compact per-IP summary. Snapshot (conn_counts.json) and warnings
(conn_warnings.json) live next to clientsTable; get_clients just reads
those small files (one-off live fallback until the first collector round).
Detection now works 24/7; UI, badges and the trash button are unchanged.
Three separate problems, none of them new to this branch.
The vless link carried the connection's own label in its fragment, and
vless::Deserialize hands that fragment to extractXrayConfig as the server
description -- so an imported key showed up as "Connection". It now carries
the same node-plus-container name the AmneziaWG configs got.
The `vpn://` key was base64 of the vless link, which the client cannot read:
extractConfigFromData only routes a *bare* `vless://` string to the Xray
branch, and once it is wrapped nothing recognises the payload. That is where
the ErrorCode 900 (ImportInvalidConfigError) came from, and it predates this
branch -- main wraps every protocol the same way.
The QR had the same shape of problem from the other side:
extractConfigFromQr only reaches extractConfigFromData when checkConfigFormat
already recognises the text, and a bare vless link matches none of its
patterns, so a link in a QR code is unreachable however well it scans.
So Xray now goes through the same Amnezia config format as AmneziaWG:
build_xray_client_config ports serialization::vless::Deserialize, wraps its
output the way extractXrayConfig would, and the result feeds both the `vpn://`
key and the QR frame series. Four frames for a typical reality link.
The plain-format QR is still there for v2rayNG and friends, so its label is no
longer "WireGuard".
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- per-manager lock around connect/disconnect: UI handler and background
monitor can no longer race a half-built transport
- transport keepalive 30s: NAT/firewalls won't silently drop idle tunnels
- one reconnect+retry when exec fails on a dead-but-'active' transport
instead of surfacing a spurious error to the UI
- SSHManager.ensure_connected(): keep the transport alive, reconnect only
when it died; run_command auto-heals the connection
- app.py: pool SSHManager per (host, port, username) instead of a fresh
TCP+SSH handshake for every API call - the main cause of UI timeouts on
high-latency servers (each 6s refresh paid a 1-2s handshake)
- awg_manager: 10s TTL cache for config path resolution and server config
reads (was: the same awg0.conf cat'ed 3-4x per refresh); caches are
invalidated on save_server_config
- per-manager lock around connect/disconnect: UI handler and background
monitor can no longer race a half-built transport
- transport keepalive 30s: NAT/firewalls won't silently drop idle tunnels
- one reconnect+retry when exec fails on a dead-but-'active' transport
instead of surfacing a spurious error to the UI
- SSHManager.ensure_connected(): keep the transport alive, reconnect only
when it died; run_command auto-heals the connection
- app.py: pool SSHManager per (host, port, username) instead of a fresh
TCP+SSH handshake for every API call - the main cause of UI timeouts on
high-latency servers (each 6s refresh paid a 1-2s handshake)
- awg_manager: 10s TTL cache for config path resolution and server config
reads (was: the same awg0.conf cat'ed 3-4x per refresh); caches are
invalidated on save_server_config
Before: every 6s UI refresh pulled up to 8MB of raw /proc/net/nf_conntrack
over SSH and detection only ran while someone watched the page.
Now: a background monitor thread (60s) runs one cheap SSH roundtrip per
AWG instance - an awk aggregation inside the container that transfers only
the compact per-IP summary. Snapshot (conn_counts.json) and warnings
(conn_warnings.json) live next to clientsTable; get_clients just reads
those small files (one-off live fallback until the first collector round).
Detection now works 24/7; UI, badges and the trash button are unchanged.
The updated AmneziaWG docs prescribe 1,2,3,4 when Header Protection is
enabled (custom-header mechanism off, HP hides the message type) - this
is what the native AmneziaVPN client ships. Ranged H with
RandomTrailers=on cause silent transport loss (amneziawg-go#186,
amneziawg-linux-kernel-module#226).
The updated AmneziaWG docs state that with Header Protection enabled
H1-H4 should stay at 1,2,3,4: the custom-header mechanism is off and
Header Protection (ChaCha20 with the random per-server key) hides the
message type. This is exactly what the native AmneziaVPN client ships.
Ranged H with RandomTrailers=on cause transport packet loss
(amneziawg-go#186, amneziawg-linux-kernel-module#226).
login.html carries its own <head> instead of extending base.html, so it
kept requesting the unversioned stylesheet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The card header and the QR quiet zone were already correct in the stylesheet,
but nobody was seeing them: /static is served with an ETag and no
Cache-Control, and it sits behind a proxying CDN, so browsers kept the copy
they had and rendered the new markup against the old rules. Stamp the static
links with the newest mtime under static/.
From the review:
- specialJunkField() built ids as `${prefix}Awg${KEY}`, which matches the
install form's installAwgI1 but not the settings modal's awgSetI1. The
modal's I1-I5 were therefore never filled in, and saving threw on a null
element. Callers now pass the whole id prefix.
- join_dns() collapses two blank fields to None, and update_awg_settings()
reads None as "leave DNS alone", so DNS could never be cleared from the UI.
The route now tells "not sent" from "sent empty", and an empty value drops
the line so the built-in default applies again. Same for MTU.
- save_client_config() indexed only DNS into userData, leaving the
userData.mtu branch of _get_mtu() unreachable. It now indexes MTU too, so
editing MTU in a connection's config sticks across regeneration.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The QR never scanned, before any of this branch's changes: qrcode.js paints
the modules edge to edge with no quiet zone, and against the dark page the
finder patterns sit directly on the background. Simulating a 640x480 capture,
nothing decodes that way -- not the frame series, not the raw config, at any
size. With a 32px white frame around the code all eight frames decode at every
scale tried. So the earlier density work was necessary but not sufficient.
Rounding is dropped from the code itself as well, since a border-radius large
enough to see clips the corner finder patterns.
The card header now carries the protocol name next to its icon, and the
control buttons get a row of their own underneath, where three of them fit
without crowding anything.
Button labels rode high whenever the label opened with a symbol glyph: U+23F9
in the stop button falls back to a font with much taller metrics, which grows
the line box downwards. A fixed line-height keeps the label centred.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two problems with the previous commit's UI.
The header row of a protocol card is a bare space-between flex with no gap,
so the third control button ran straight into the protocol icon on the AWG
cards -- the only ones that get an AWG button. Give the row a gap and let the
button group wrap instead of pushing into the icon.
And the QR: a whole config in one code lands at version 19 raw or 26 wrapped,
while the Android scanner builds ImageAnalysis.Builder() with no
ResolutionSelector and so reads 640x480 frames -- two to three pixels per
module. Emit the frame series ImportController::parseQrCodeChunk reassembles
instead: qint16 magic 1984, quint8 total, quint8 index and the slice as a
QDataStream QByteArray, each frame base64url'd into its own code. At 144 bytes
a frame every code stays under 55x55 modules and decoded at every scale tried
against a simulated VGA capture, including ones where the single code failed.
The WireGuard format stays a single static code, since a raw config is what
AmneziaWG and wg-quick read and it cannot be chunked.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A plain WireGuard config cannot carry a name: extractWireGuardConfig() in
the client overwrites description with nextAvailableServerName(), so every
imported key lands as "Server 1". Wrap the config into Amnezia's own server
config format instead, which keeps whatever description it is given, and
name it after the node and the container it came from -- "prx-40 AWG3".
The encoding matches ExportController::generateVpnUrl: base64url of
qCompress'd JSON, the size prefix included. The QR payload carries no
vpn:// prefix, because extractConfigFromQr() feeds the scanned text
straight to QByteArray::fromBase64, which drops ':' and '/' but keeps
'v', 'p' and 'n' and would shift the whole payload by three characters.
AmneziaWG and wg-quick only understand the raw config, so the QR panel
gets a format switch rather than replacing what it shows. The named
payload is about half again as long -- QR version 23 instead of 18 --
so it is drawn a little larger.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Previously the install modal defaulted to a fixed port and only avoided
ports of same-family instances, so installing e.g. AWG3 on a host where
AWG2 already held 55424 failed mid-install with a half-created broken
container ('port is already allocated').
- GET /api/servers/{id}/used-ports: real listening UDP/TCP ports via ss
- api_install_protocol: reject a busy port upfront with a clear error
naming the owning process, before any docker run
- Install modal: fetches used ports, auto-suggests the first free port,
live-validates manual input (red field + hint + disabled Install button)
- new translation key port_in_use_by (en/ru/fr/fa/zh)
A click starting inside an input and ending outside the modal fired the
backdrop click handler (click target = common ancestor). Now the modal
closes only when mousedown and click both land on the backdrop itself.
The grid rendered all static protocol tiles until the status response
arrived and applyInstalledAppsVisibility() hid the non-installed ones.
Add .apps-pending on the grid (set in HTML, toggled by
setInstalledAppsLoading) that hides tiles while the check runs.
A click starting inside an input and ending outside the modal fired the
backdrop click handler (click target = common ancestor). Now the modal
closes only when mousedown and click both land on the backdrop itself.
The grid rendered all static protocol tiles until the status response
arrived and applyInstalledAppsVisibility() hid the non-installed ones.
Add .apps-pending on the grid (set in HTML, toggled by
setInstalledAppsLoading) that hides tiles while the check runs.
Without ip6tables Docker creates no MASQUERADE rule for the
fixed-cidr-v6 ULA subnet, so container v6 traffic leaves with an
unroutable address. Keys are now enforced unconditionally (docker
restarted only on change) so hosts that already have ipv6:true still
pick up the missing ip6tables/experimental keys.
Without ip6tables Docker creates no MASQUERADE rule for the
fixed-cidr-v6 ULA subnet, so container v6 traffic leaves with an
unroutable address. daemon.json keys are now enforced unconditionally
(restart only on change), so hosts already having ipv6:true still get
the missing ip6tables/experimental keys.
Even with an IPv6-enabled daemon, containers are created with
net.ipv6.conf.*.disable_ipv6=1, and the flag is fixed at netns creation.
awg-quick then fails on 'ip -6 address add' (RTNETLINK: Permission
denied) and rolls back by deleting awg0 entirely, killing IPv4 too.
Detect host IPv6 before docker run and pass the sysctls at creation.
Containers created without net.ipv6.conf.*.disable_ipv6=0 keep the flag
forever (it is fixed at netns creation). awg-quick then fails on
'ip -6 address add' with RTNETLINK Permission denied and rolls back by
deleting the whole awg0 interface - killing IPv4 too. Detect host IPv6
before docker run and pass the sysctls at creation time.
The torrent-detection warning block under a peer now has a 🗑 button that
wipes the recorded warning history for that peer (conn_warnings.json is
keyed by peer IP; backend resolves the IP from clientsTable).
Adds POST /api/servers/{id}/connections/clear_warnings and
clear_warnings / warnings_cleared translation keys.
The torrent-detection warning block under a peer now has a 🗑 button that
wipes the recorded warning history for that peer (conn_warnings.json is
keyed by peer IP; backend resolves the IP from clientsTable).
Adds POST /api/servers/{id}/connections/clear_warnings and
clear_warnings / warnings_cleared translation keys.
- Rename dialog gains a numeric input (step 0.1, 0 = unlimited) for AWG
peers; peer list shows a badge: infinity or '⚡X Mbps'.
- Limit stored in clientsTable userData.maxSpeed; enforced via tc inside
the container: HTB class per peer IP on awg0 egress (download) and an
ingress policer (upload), IPv4+IPv6.
- Limits are flattened to /opt/amnezia/awg/bwlimits (next to
clientsTable) and re-applied at container start from start.sh; applied
live on every clientsTable save.
- API: RenameConnectionRequest.max_speed (-1 = don't touch); works for
managers exposing set_speed_limit (AWG), ignored elsewhere.
Usernames and emails are latin even when the panel runs in Persian (the
only locale that sets dir="rtl"). Inheriting the RTL direction pushes such
a string to the right edge and reorders its trailing punctuation, so
"a.zharkova@example.com (user)" renders with the parens and dots in the
wrong place. dir="auto" lets the browser pick per string: latin entries
lay out LTR, Persian ones stay RTL.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
On a panel with a few dozen users, picking one when creating a connection
means scrolling a plain <select> and reading every entry — there is no way
to type a name.
Adds a small dependency-free searchable select and applies it to the user
picker in the Add Connection modal. It's progressive enhancement: the
native <select> stays in the DOM as the source of truth, so `.value`,
programmatic assignment and `change` listeners keep working exactly as
before (server.html reads `connectionUserId.value` unchanged).
- static/js/searchable-select.js: opt-in via `data-searchable`, with
case-insensitive substring filtering, keyboard navigation
(arrows/Enter/Escape/Tab), an empty state, and ARIA combobox roles
- styles built entirely from existing CSS variables, so light/dark themes
and RTL follow the rest of the panel
- labels come from `data-search-*` attributes, so strings stay in the
templates; new keys added to all five locales
No jQuery/select2: the panel ships no jQuery today, and pulling in two
libraries for one dropdown seemed a poor trade against ~300 lines of
vanilla JS.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
leonidorlov-hash