Three separate problems, none of them new to this branch.
The vless link carried the connection's own label in its fragment, and
vless::Deserialize hands that fragment to extractXrayConfig as the server
description -- so an imported key showed up as "Connection". It now carries
the same node-plus-container name the AmneziaWG configs got.
The `vpn://` key was base64 of the vless link, which the client cannot read:
extractConfigFromData only routes a *bare* `vless://` string to the Xray
branch, and once it is wrapped nothing recognises the payload. That is where
the ErrorCode 900 (ImportInvalidConfigError) came from, and it predates this
branch -- main wraps every protocol the same way.
The QR had the same shape of problem from the other side:
extractConfigFromQr only reaches extractConfigFromData when checkConfigFormat
already recognises the text, and a bare vless link matches none of its
patterns, so a link in a QR code is unreachable however well it scans.
So Xray now goes through the same Amnezia config format as AmneziaWG:
build_xray_client_config ports serialization::vless::Deserialize, wraps its
output the way extractXrayConfig would, and the result feeds both the `vpn://`
key and the QR frame series. Four frames for a typical reality link.
The plain-format QR is still there for v2rayNG and friends, so its label is no
longer "WireGuard".
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two problems with the previous commit's UI.
The header row of a protocol card is a bare space-between flex with no gap,
so the third control button ran straight into the protocol icon on the AWG
cards -- the only ones that get an AWG button. Give the row a gap and let the
button group wrap instead of pushing into the icon.
And the QR: a whole config in one code lands at version 19 raw or 26 wrapped,
while the Android scanner builds ImageAnalysis.Builder() with no
ResolutionSelector and so reads 640x480 frames -- two to three pixels per
module. Emit the frame series ImportController::parseQrCodeChunk reassembles
instead: qint16 magic 1984, quint8 total, quint8 index and the slice as a
QDataStream QByteArray, each frame base64url'd into its own code. At 144 bytes
a frame every code stays under 55x55 modules and decoded at every scale tried
against a simulated VGA capture, including ones where the single code failed.
The WireGuard format stays a single static code, since a raw config is what
AmneziaWG and wg-quick read and it cannot be chunked.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A plain WireGuard config cannot carry a name: extractWireGuardConfig() in
the client overwrites description with nextAvailableServerName(), so every
imported key lands as "Server 1". Wrap the config into Amnezia's own server
config format instead, which keeps whatever description it is given, and
name it after the node and the container it came from -- "prx-40 AWG3".
The encoding matches ExportController::generateVpnUrl: base64url of
qCompress'd JSON, the size prefix included. The QR payload carries no
vpn:// prefix, because extractConfigFromQr() feeds the scanned text
straight to QByteArray::fromBase64, which drops ':' and '/' but keeps
'v', 'p' and 'n' and would shift the whole payload by three characters.
AmneziaWG and wg-quick only understand the raw config, so the QR panel
gets a format switch rather than replacing what it shows. The named
payload is about half again as long -- QR version 23 instead of 18 --
so it is drawn a little larger.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Previously the install modal defaulted to a fixed port and only avoided
ports of same-family instances, so installing e.g. AWG3 on a host where
AWG2 already held 55424 failed mid-install with a half-created broken
container ('port is already allocated').
- GET /api/servers/{id}/used-ports: real listening UDP/TCP ports via ss
- api_install_protocol: reject a busy port upfront with a clear error
naming the owning process, before any docker run
- Install modal: fetches used ports, auto-suggests the first free port,
live-validates manual input (red field + hint + disabled Install button)
- new translation key port_in_use_by (en/ru/fr/fa/zh)
The torrent-detection warning block under a peer now has a 🗑 button that
wipes the recorded warning history for that peer (conn_warnings.json is
keyed by peer IP; backend resolves the IP from clientsTable).
Adds POST /api/servers/{id}/connections/clear_warnings and
clear_warnings / warnings_cleared translation keys.
On a panel with a few dozen users, picking one when creating a connection
means scrolling a plain <select> and reading every entry — there is no way
to type a name.
Adds a small dependency-free searchable select and applies it to the user
picker in the Add Connection modal. It's progressive enhancement: the
native <select> stays in the DOM as the source of truth, so `.value`,
programmatic assignment and `change` listeners keep working exactly as
before (server.html reads `connectionUserId.value` unchanged).
- static/js/searchable-select.js: opt-in via `data-searchable`, with
case-insensitive substring filtering, keyboard navigation
(arrows/Enter/Escape/Tab), an empty state, and ARIA combobox roles
- styles built entirely from existing CSS variables, so light/dark themes
and RTL follow the rest of the panel
- labels come from `data-search-*` attributes, so strings stay in the
templates; new keys added to all five locales
No jQuery/select2: the panel ships no jQuery today, and pulling in two
libraries for one dropdown seemed a poor trade against ~300 lines of
vanilla JS.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Container image (Dockerfile):
- writes sysctl tuning into /etc/sysctl.conf (64MB socket buffers,
netdev_max_backlog, somaxconn, tcp_fastopen=3, tcp_mtu_probing, etc.),
same set the AmneziaVPN client uses, minus hybla which needs a kernel
module on the host
- start.sh applies it via 'sysctl -p' at container start (Alpine does
not apply sysctl.conf by itself)
- docker run gets --ulimit nofile=51200:51200 (limits.conf has no
effect on containers)
Host (new setup_host_tuning() step in install_protocol):
- enables BBR + fq qdisc, loads tcp_bbr if needed, persists via
/etc/sysctl.d/99-awp-bbr.conf and /etc/modules-load.d/awp-bbr.conf
- silently skipped when the kernel lacks BBR
UI:
- new 'Host tuning' button in the server status bar opens a modal with
live host sysctls (congestion control, qdisc, conntrack usage,
backlog, somaxconn) and per-AWG-container values (buffers, fastopen,
mtu_probing, nofile) + container online status
- adds POST /api/servers/{id}/host_tuning and host_tuning translations
- Count conntrack entries per peer IP from /proc/net/nf_conntrack (no extra
packages on the host), matching against the instance subnet
- Record a warning when a peer exceeds 600 simultaneous connections,
at most one per hour per peer, keeping the last 5 events; persisted in
conn_warnings.json inside the container data dir (volume-backed)
- Render warnings under the client meta row (.conn-warnings/.conn-warning,
no inline styles), localized via new conn_warning_text key (en/ru/fr/fa/zh)
- Show peer internal IP next to the client name (.client-ip)
v1.6.0 landed the same fix for the unbound `dns1`/`dns2` in the client
config builders that this branch carries, and wires in the dual-stack
`address_line`/`dns_line` the same way. Merged as-is; the MTU lookup
from this branch stays on top of it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The install dialog gains an AmneziaWG section, and installed AWG
protocols gain an "AWG" button next to the raw config editor that opens
the same fields for editing. A "Default" button fills I1 with the packet
the desktop client uses, so the common case is one click.
AWG Legacy predates special junk packets, so it only gets MTU and DNS.
The dialog says outright that changes apply to configs generated from
now on: a client that already imported a config keeps its old values,
because the values live in the config it holds.
fr/zh/fa strings are machine-written and want a native reader.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The awg3 card reused awg_desc, which talks about awg-go and S3/S4 — true
of 2.0 as well, so the card said nothing about what the newer protocol
actually changes. Give it its own key naming the 3.x additions: header
protection, content padding and randomized timings.
_t() falls back to the key itself rather than to English, so the string is
added to all five locales at once.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add public tunnel management and fix connection stability issues
- Add Tunnels block to settings with Local Server, Cloudflare Quick Tunnel, and ngrok support
- Implement one-click tunnel install, enable, stop, and delete actions
- Persist tunnel PID and public URL state across panel restarts
- Improve tunnel process detection and cleanup on Windows, Linux, and Docker
- Add tunnel translations and README documentation
- Fix settings save 422 when server list is empty and Remnawave auto-create is disabled
- Fix AWG Legacy config path resolution by detecting actual wg0.conf/awg0.conf inside container
- Fix Xray client add/toggle/remove flow to use runtime API without restarting the container
- Fix WireGuard Show config calls by routing get_client_config through the unified manager adapter
Add SOCKS5 support
Add AdGuard Home integration
Add node status and latency tracking
Add drag-and-drop server management
Upgrade Xray from v1.8 to v26.3.27 with backward compatibility
Fix Telemt dependency installation
Extend Telegram bot to support all protocols
Improve server cleanup process
Enhance API structure (system routes moved to a separate group)
Add JWT token generation for external integrations
* Added support for AmneziaDNS
* Added traffic reset functionality
* Fixed hideConnectionsSection is not defined error and false “Connection Error” when clearing the server
* Added basic management features (restart, delete, poll, clear)
* Fixed AWG 2.0 connection generation
* Optimized Check Server polling speed (now queries all protocols and services in parallel over a single SSH connection; ~5–6x faster)
* Added support for Amnezia 2.0
* Added support for native installation of Amnezia 2.0
* Added display of messages when attempting to view files created by a native application
* Improved polling of native installation servers while preserving active protocols
* Added editing of the main config file via the web panel
