Add Hysteria 2 protocol with admin domain SSL via Let's Encrypt.

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -804,8 +804,8 @@ async def wait_for_tunnel_url(provider: str, seconds: int = 20):
     return get_tunnel_status(provider)
 
 
-BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
-MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'socks5'}
+BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
+MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'}
 
 
 def protocol_base(protocol: str) -> str:
@@ -845,6 +845,7 @@ def protocol_display_name(protocol: str) -> str:
         'awg_legacy': 'AmneziaWG Legacy',
         'xray': 'Xray',
         'telemt': 'Telemt',
+        'hysteria': 'Hysteria 2',
         'dns': 'AmneziaDNS',
         'wireguard': 'WireGuard',
         'socks5': 'SOCKS5',
@@ -864,6 +865,7 @@ def protocol_container_name(protocol: str) -> Optional[str]:
         'awg_legacy': 'amnezia-awg-legacy',
         'xray': 'amnezia-xray',
         'telemt': 'telemt',
+        'hysteria': 'amnezia-hysteria',
         'dns': 'amnezia-dns',
         'wireguard': 'amnezia-wireguard',
         'socks5': 'amnezia-socks5proxy',
@@ -903,6 +905,9 @@ def get_protocol_manager(ssh, protocol: str):
     elif base == 'nginx':
         from managers.nginx_manager import NginxManager
         return NginxManager(ssh, protocol)
+    elif base == 'hysteria':
+        from managers.hysteria_manager import HysteriaManager
+        return HysteriaManager(ssh, protocol)
     from managers.awg_manager import AWGManager
     return AWGManager(ssh)
 
@@ -964,7 +969,7 @@ def _manager_call(manager, method, protocol, *args, **kwargs):
 
 
 # Protocols that own VPN clients (can list/link connections)
-CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'xui'}
+CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'hysteria', 'xui'}
 
 
 def generate_vpn_link(config_text):
@@ -1684,6 +1689,9 @@ class InstallProtocolRequest(BaseModel):
     # NGINX
     nginx_domain: Optional[str] = None
     nginx_email: Optional[str] = None
+    # Hysteria
+    hysteria_domain: Optional[str] = None
+    hysteria_email: Optional[str] = None
 
 
 class Socks5SettingsRequest(BaseModel):
@@ -2839,6 +2847,13 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
                 domain=req.nginx_domain,
                 email=req.nginx_email,
             )
+        elif install_base == 'hysteria':
+            result = manager.install_protocol(
+                protocol_type=install_protocol,
+                port=req.port,
+                domain=req.hysteria_domain,
+                email=req.hysteria_email,
+            )
         else:
             result = manager.install_protocol(install_protocol, port=req.port)
 
@@ -2865,6 +2880,9 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
             proto_record['domain'] = result.get('domain')
             proto_record['email'] = result.get('email')
             proto_record['site_url'] = result.get('site_url')
+        if install_base == 'hysteria':
+            proto_record['domain'] = result.get('domain')
+            proto_record['email'] = result.get('email')
         proto_record['base_protocol'] = install_base
         proto_record['instance'] = protocol_instance(install_protocol)
         proto_record['display_name'] = protocol_display_name(install_protocol)
@@ -2973,6 +2991,7 @@ CONTAINER_NAMES = {
     'awg_legacy': 'amnezia-awg-legacy',
     'xray': 'amnezia-xray',
     'telemt': 'telemt',
+    'hysteria': 'amnezia-hysteria',
     'dns': 'amnezia-dns',
     'wireguard': 'amnezia-wireguard',
     'socks5': 'amnezia-socks5proxy',
@@ -3161,6 +3180,10 @@ async def api_server_config(request: Request, server_id: int, req: ProtocolReque
             from managers.nginx_manager import NginxManager
             mgr = NginxManager(ssh, req.protocol)
             config = mgr._get_server_config(req.protocol)
+        elif protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            config = mgr.get_server_config(req.protocol)
         else:
             mgr = AWGManager(ssh)
             config = mgr._get_server_config(req.protocol)
@@ -3205,6 +3228,10 @@ async def api_server_config_save(request: Request, server_id: int, req: ServerCo
             from managers.nginx_manager import NginxManager
             mgr = NginxManager(ssh, req.protocol)
             mgr.save_server_config(req.protocol, req.config)
+        elif protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            mgr.save_server_config(req.protocol, req.config)
         else:
             mgr = AWGManager(ssh)
             mgr.save_server_config(req.protocol, req.config)

managers/backup_manager.py

@@ -62,6 +62,10 @@ class BackupManager:
             remote_dir = inst_path('/opt/amnezia/telemt')
             paths['host'] = [remote_dir]
             paths['container'] = [remote_dir]
+        elif base == 'hysteria':
+            remote_dir = inst_path('/opt/amnezia/hysteria')
+            paths['host'] = [remote_dir]
+            paths['container'] = ['/etc/hysteria']
         elif base == 'dns':
             paths['host'] = ['/opt/amnezia/dns']
             paths['container'] = ['/opt/amnezia/dns']

managers/hysteria_manager.py

@@ -0,0 +1,410 @@
+"""
+Hysteria 2 protocol manager — teddysun/hysteria Docker image.
+
+Installs Hysteria with Let's Encrypt TLS for an admin-provided domain
+(certbot standalone on port 80), then runs the UDP QUIC server.
+Clients use userpass auth; share links are hysteria2:// URIs.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+import secrets
+import shlex
+import string
+from urllib.parse import quote
+
+logger = logging.getLogger(__name__)
+
+
+def _q(value):
+    return shlex.quote(str(value))
+
+
+def _rand_token(length=16):
+    alphabet = string.ascii_lowercase + string.digits
+    return ''.join(secrets.choice(alphabet) for _ in range(length))
+
+
+class HysteriaManager:
+    PROTOCOL = 'hysteria'
+    CONTAINER_NAME = 'amnezia-hysteria'
+    IMAGE_NAME = 'teddysun/hysteria:latest'
+    CERTBOT_IMAGE = 'certbot/certbot:latest'
+    BASE_DIR = '/opt/amnezia/hysteria'
+    DEFAULT_PORT = 8998
+
+    def __init__(self, ssh, protocol='hysteria'):
+        self.ssh = ssh
+        self.protocol = protocol or self.PROTOCOL
+        self.instance = self._instance_index(self.protocol)
+        self.container_name = self._container_name(self.protocol)
+        self.base_dir = self._base_dir(self.protocol)
+        self.config_path = f'{self.base_dir}/server.yaml'
+        self.clients_path = f'{self.base_dir}/clients.json'
+        self.meta_path = f'{self.base_dir}/metadata.json'
+        self.cert_path = f'{self.base_dir}/cert.crt'
+        self.key_path = f'{self.base_dir}/private.key'
+        self.letsencrypt_dir = f'{self.base_dir}/letsencrypt'
+
+    def _instance_index(self, protocol=None):
+        parts = str(protocol or self.protocol or '').split('__', 1)
+        if len(parts) == 2:
+            try:
+                return max(1, int(parts[1]))
+            except ValueError:
+                return 1
+        return 1
+
+    def _container_name(self, protocol=None):
+        idx = self._instance_index(protocol or self.protocol)
+        return self.CONTAINER_NAME if idx <= 1 else f'{self.CONTAINER_NAME}-{idx}'
+
+    def _base_dir(self, protocol=None):
+        idx = self._instance_index(protocol or self.protocol)
+        return self.BASE_DIR if idx <= 1 else f'{self.BASE_DIR}-{idx}'
+
+    # ===================== STATUS =====================
+
+    def check_docker_installed(self):
+        out, _, code = self.ssh.run_command("docker --version 2>/dev/null")
+        if code != 0:
+            return False
+        out2, _, _ = self.ssh.run_command(
+            "systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
+        )
+        return 'active' in out2 or 'running' in out2.lower()
+
+    def check_protocol_installed(self, protocol_type=None):
+        name = self._container_name(protocol_type or self.protocol)
+        out, _, _ = self.ssh.run_sudo_command(
+            f"docker ps -a --filter name=^{name}$ --format '{{{{.Names}}}}'"
+        )
+        return name in out.strip().split('\n')
+
+    def check_container_running(self, protocol_type=None):
+        name = self._container_name(protocol_type or self.protocol)
+        out, _, _ = self.ssh.run_sudo_command(
+            f"docker ps --filter name=^{name}$ --format '{{{{.Status}}}}'"
+        )
+        return 'Up' in out
+
+    def get_server_status(self, protocol_type=None):
+        protocol_type = protocol_type or self.protocol
+        exists = self.check_protocol_installed(protocol_type)
+        running = self.check_container_running(protocol_type)
+        meta = self._read_metadata() if exists else {}
+        clients = self._read_clients() if exists else []
+        return {
+            'container_exists': exists,
+            'container_running': running,
+            'port': int(meta.get('port') or self.DEFAULT_PORT),
+            'domain': meta.get('domain'),
+            'email': meta.get('email'),
+            'clients_count': len(clients),
+            'protocol': protocol_type,
+            'base_protocol': self.PROTOCOL,
+            'instance': self._instance_index(protocol_type),
+            'container_name': self._container_name(protocol_type),
+        }
+
+    # ===================== HELPERS =====================
+
+    def _validate_domain(self, domain):
+        domain = (domain or '').strip().lower()
+        if not domain or len(domain) > 253:
+            raise ValueError('Domain is required for Hysteria SSL')
+        if not re.match(r'^(?!-)[a-z0-9.-]+(?<!-)$', domain) or '.' not in domain:
+            raise ValueError('Invalid domain name')
+        return domain
+
+    def _validate_email(self, email):
+        email = (email or '').strip()
+        if not email or '@' not in email:
+            raise ValueError("Valid Let's Encrypt email is required")
+        return email
+
+    def _read_file(self, path):
+        out, _, code = self.ssh.run_sudo_command(f"cat {_q(path)} 2>/dev/null")
+        return out if code == 0 else ''
+
+    def _write_file(self, path, content):
+        parent = path.rsplit('/', 1)[0]
+        self.ssh.run_sudo_command(f"mkdir -p {_q(parent)}")
+        self.ssh.upload_file_sudo(content, path)
+
+    def _read_metadata(self):
+        raw = self._read_file(self.meta_path)
+        if not raw.strip():
+            return {}
+        try:
+            return json.loads(raw)
+        except Exception:
+            return {}
+
+    def _write_metadata(self, meta):
+        self._write_file(self.meta_path, json.dumps(meta, indent=2, ensure_ascii=False))
+
+    def _read_clients(self):
+        raw = self._read_file(self.clients_path)
+        if not raw.strip():
+            return []
+        try:
+            data = json.loads(raw)
+            return data if isinstance(data, list) else []
+        except Exception:
+            return []
+
+    def _write_clients(self, clients):
+        self._write_file(self.clients_path, json.dumps(clients, indent=2, ensure_ascii=False))
+
+    def _build_server_yaml(self, port, clients):
+        lines = [
+            f'listen: :{int(port)}',
+            '',
+            'tls:',
+            '  cert: /etc/hysteria/cert.crt',
+            '  key: /etc/hysteria/private.key',
+            '',
+            'auth:',
+            '  type: userpass',
+            '  userpass:',
+        ]
+        if clients:
+            for c in clients:
+                user = str(c.get('username') or '').strip()
+                pwd = str(c.get('password') or '').strip()
+                if user and pwd:
+                    # YAML double-quote to allow special chars
+                    lines.append(f'    "{user}": "{pwd}"')
+        else:
+            # Placeholder so Hysteria starts; first real client replaces this
+            lines.append(f'    "__bootstrap__": "{_rand_token(24)}"')
+        lines.extend([
+            '',
+            'masquerade:',
+            '  type: proxy',
+            '  proxy:',
+            '    url: https://www.bing.com',
+            '    rewriteHost: true',
+            '',
+        ])
+        return '\n'.join(lines)
+
+    def _write_config_from_clients(self, port=None):
+        meta = self._read_metadata()
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        clients = self._read_clients()
+        self._write_file(self.config_path, self._build_server_yaml(port, clients))
+        return port
+
+    def _reload_container(self):
+        name = self.container_name
+        if self.check_container_running(self.protocol):
+            self.ssh.run_sudo_command(f"docker restart {name}", timeout=60)
+
+    def _issue_certificate(self, domain, email):
+        """Issue Let's Encrypt cert via certbot standalone (needs free TCP 80)."""
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.letsencrypt_dir)}")
+        self.ssh.run_sudo_command(f"docker pull {self.CERTBOT_IMAGE}", timeout=180)
+
+        # Stop anything briefly occupying 80 if it's our leftover certbot
+        self.ssh.run_sudo_command(
+            "docker rm -fv amnezia-hysteria-certbot 2>/dev/null || true"
+        )
+
+        cmd = (
+            f"docker run --rm --name amnezia-hysteria-certbot "
+            f"-p 80:80 "
+            f"-v {_q(self.letsencrypt_dir)}:/etc/letsencrypt "
+            f"{self.CERTBOT_IMAGE} certonly --standalone "
+            f"--non-interactive --agree-tos --no-eff-email "
+            f"--email {_q(email)} -d {_q(domain)}"
+        )
+        out, err, code = self.ssh.run_sudo_command(cmd, timeout=300)
+        if code != 0:
+            raise RuntimeError(
+                f"Let's Encrypt failed for {domain}. "
+                f"Point A-record to this server and free TCP port 80. {err or out}"
+            )
+
+        # Copy live certs into paths expected by teddysun image
+        copy_script = f"""
+set -e
+LIVE={_q(self.letsencrypt_dir)}/live/{_q(domain)}
+test -s "$LIVE/fullchain.pem"
+test -s "$LIVE/privkey.pem"
+cp -f "$LIVE/fullchain.pem" {_q(self.cert_path)}
+cp -f "$LIVE/privkey.pem" {_q(self.key_path)}
+chmod 644 {_q(self.cert_path)}
+chmod 600 {_q(self.key_path)}
+"""
+        out, err, code = self.ssh.run_sudo_command(f"sh -c {_q(copy_script)}", timeout=30)
+        if code != 0:
+            raise RuntimeError(f'Failed to install certificate files: {err or out}')
+
+    def _build_share_uri(self, host, port, domain, username, password, name):
+        userinfo = f"{quote(username, safe='')}:{quote(password, safe='')}"
+        fragment = quote(name or username, safe='')
+        sni = domain or host
+        conn_host = domain or host
+        return (
+            f"hysteria2://{userinfo}@{conn_host}:{int(port)}/"
+            f"?sni={quote(sni, safe='')}&insecure=0#{fragment}"
+        )
+
+    # ===================== INSTALL / REMOVE =====================
+
+    def install_protocol(self, protocol_type=None, port=None, domain=None, email=None):
+        protocol_type = protocol_type or self.protocol
+        if not self.check_docker_installed():
+            return {'status': 'error', 'message': 'Docker not installed'}
+
+        domain = self._validate_domain(domain)
+        email = self._validate_email(email)
+        port = int(port or self.DEFAULT_PORT)
+        if port == 80:
+            return {'status': 'error', 'message': 'Port 80 is reserved for Let\'s Encrypt validation'}
+
+        log = []
+        self.ssh.run_sudo_command(f"docker pull {self.IMAGE_NAME}", timeout=180)
+        log.append(f'Pulled {self.IMAGE_NAME}')
+
+        if self.check_protocol_installed(protocol_type):
+            self.remove_container(protocol_type)
+            log.append('Removed previous container')
+
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.base_dir)}")
+        self._write_clients([])
+        self._write_metadata({
+            'domain': domain,
+            'email': email,
+            'port': port,
+        })
+        self._write_config_from_clients(port)
+        log.append('Prepared config directory')
+
+        try:
+            self._issue_certificate(domain, email)
+            log.append(f"Issued Let's Encrypt certificate for {domain}")
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+
+        # Map host dir to /etc/hysteria as required by teddysun image
+        run_cmd = (
+            f"docker run -d --restart always "
+            f"--name {self.container_name} "
+            f"--cap-add=NET_ADMIN "
+            f"-p {port}:{port}/udp "
+            f"-v {_q(self.base_dir)}:/etc/hysteria "
+            f"{self.IMAGE_NAME}"
+        )
+        _, err, code = self.ssh.run_sudo_command(run_cmd, timeout=60)
+        if code != 0:
+            return {'status': 'error', 'message': f'Failed to start Hysteria: {err}', 'log': log}
+
+        log.append(f'Started {self.container_name} on UDP {port}')
+        return {
+            'status': 'success',
+            'message': 'Hysteria installed',
+            'log': log,
+            'port': str(port),
+            'domain': domain,
+            'email': email,
+        }
+
+    def remove_container(self, protocol_type=None):
+        protocol_type = protocol_type or self.protocol
+        name = self._container_name(protocol_type)
+        base = self._base_dir(protocol_type)
+        self.ssh.run_sudo_command(f"docker rm -fv {name} 2>/dev/null || true")
+        self.ssh.run_sudo_command(f"rm -rf {_q(base)}")
+        return True
+
+    def get_server_config(self, protocol_type=None):
+        return self._read_file(self.config_path)
+
+    def save_server_config(self, protocol_type=None, config_text=''):
+        self._write_file(self.config_path, config_text or '')
+        self._reload_container()
+        return True
+
+    # ===================== CLIENTS =====================
+
+    def get_clients(self, protocol_type=None):
+        clients = self._read_clients()
+        result = []
+        for c in clients:
+            result.append({
+                'clientId': c.get('id'),
+                'client_id': c.get('id'),
+                'id': c.get('id'),
+                'name': c.get('name') or c.get('username'),
+                'email': c.get('username'),
+                'userData': {'clientName': c.get('name') or c.get('username')},
+            })
+        return result
+
+    def add_client(self, protocol_type, name, host, port=None):
+        meta = self._read_metadata()
+        domain = meta.get('domain') or host
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        client_id = secrets.token_hex(8)
+        username = f"u_{client_id}"
+        password = _rand_token(20)
+        clients = self._read_clients()
+        clients.append({
+            'id': client_id,
+            'name': name or username,
+            'username': username,
+            'password': password,
+            'enabled': True,
+        })
+        self._write_clients(clients)
+        self._write_config_from_clients(port)
+        self._reload_container()
+        config = self._build_share_uri(host, port, domain, username, password, name or username)
+        return {'client_id': client_id, 'config': config}
+
+    def get_client_config(self, protocol_type, client_id, host, port=None):
+        meta = self._read_metadata()
+        domain = meta.get('domain') or host
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        clients = self._read_clients()
+        client = next((c for c in clients if c.get('id') == client_id), None)
+        if not client:
+            raise RuntimeError('Client not found')
+        return self._build_share_uri(
+            host, port, domain,
+            client.get('username'), client.get('password'),
+            client.get('name') or client.get('username'),
+        )
+
+    def remove_client(self, protocol_type, client_id):
+        clients = [c for c in self._read_clients() if c.get('id') != client_id]
+        self._write_clients(clients)
+        self._write_config_from_clients()
+        self._reload_container()
+        return True
+
+    def toggle_client(self, protocol_type, client_id, enable=True):
+        # Soft-disable: remove from yaml but keep in table with enabled=false
+        clients = self._read_clients()
+        found = False
+        for c in clients:
+            if c.get('id') == client_id:
+                c['enabled'] = bool(enable)
+                found = True
+                break
+        if not found:
+            raise RuntimeError('Client not found')
+        self._write_clients(clients)
+        # Rebuild yaml with only enabled clients
+        active = [c for c in clients if c.get('enabled', True)]
+        meta = self._read_metadata()
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        self._write_file(self.config_path, self._build_server_yaml(port, active))
+        self._reload_container()
+        return True

static/css/style.css

@@ -823,6 +823,11 @@ a:hover {
     color: #38bdf8;
 }
 
+.protocol-hysteria .protocol-icon {
+    background: linear-gradient(135deg, rgba(14, 165, 233, 0.2), rgba(99, 102, 241, 0.1));
+    color: #38bdf8;
+}
+
 .protocol-dns .protocol-icon {
     background: linear-gradient(135deg, rgba(34, 197, 94, 0.2), rgba(16, 185, 129, 0.1));
     color: var(--success);

telegram_bot.py

@@ -24,7 +24,7 @@ _bot_task: Optional[asyncio.Task] = None
 _callback_refs = {}
 _pending_inputs = {}
 
-CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "wireguard"}
+CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "hysteria", "wireguard"}
 SERVICE_PROTOCOLS = {"dns", "adguard", "socks5", "nginx"}
 
 
@@ -137,6 +137,7 @@ def _protocol_display_name(protocol: str) -> str:
         "awg_legacy": "AmneziaWG Legacy",
         "xray": "Xray",
         "telemt": "Telemt",
+        "hysteria": "Hysteria 2",
         "dns": "AmneziaDNS",
         "wireguard": "WireGuard",
         "socks5": "SOCKS5",
@@ -549,7 +550,7 @@ async def _send_config_by_client(api: TelegramAPI, chat_id: int, server: dict, p
         server_name = server.get("name") or server.get("host", "Unknown")
         await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server_name)}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
 
-        is_link_proto = _proto_base(proto) in ("xray", "telemt")
+        is_link_proto = _proto_base(proto) in ("xray", "telemt", "hysteria")
         if is_link_proto:
             await api.send_message(chat_id, f"🔗 <b>Connection link</b> (tap to copy):\n<code>{_e(config)}</code>")
         else:
@@ -906,7 +907,7 @@ async def _admin_create_client(api: TelegramAPI, chat_id: int, message_id: int,
 
 async def _send_config_text(api: TelegramAPI, chat_id: int, server: dict, proto: str, conn_name: str, config: str, generate_vpn_link_fn: Callable):
     await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server.get('name') or server.get('host'))}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
-    if _proto_base(proto) in ("xray", "telemt"):
+    if _proto_base(proto) in ("xray", "telemt", "hysteria"):
         await api.send_message(chat_id, f"🔗 <b>Connection link</b>:\n<code>{_e(config)}</code>")
     else:
         await api.send_message(chat_id, f"<b>📄 Configuration:</b>\n<pre>{_e(config)}</pre>")

templates/invites.html

@@ -128,7 +128,7 @@
                 {% for s in servers %}
                 {% set server_idx = loop.index0 %}
                 {% for key, info in (s.protocols or {}).items() %}
-                {% if info.installed and key.split('__')[0] in ['awg','awg2','awg_legacy','xray','wireguard','telemt'] %}
+                {% if info.installed and key.split('__')[0] in ['awg','awg2','awg_legacy','xray','wireguard','telemt','hysteria'] %}
                 <option value="{{ key }}|{{ server_idx }}">{{ s.name or s.host }} — {{ key }}</option>
                 {% endif %}
                 {% endfor %}

templates/my_connections.html

@@ -117,10 +117,10 @@
                 document.getElementById('configText').textContent = result.config;
                 document.getElementById('vpnLinkText').textContent = currentVpnLink;
 
-                // Telemt (MTProxy) doesn't have a "VPN Link" (vpn://) format in Amnezia
+                // Telemt / Hysteria use share links, not vpn:// Amnezia format
                 const vpnTab = document.querySelectorAll('.config-tab')[1];
                 const vpnPanel = document.getElementById('panel-vpn');
-                if (proto === 'telemt') {
+                if (proto === 'telemt' || String(proto || '').split('__')[0] === 'hysteria') {
                     vpnTab.style.display = 'none';
                 } else {
                     vpnTab.style.display = '';

templates/server.html

@@ -294,6 +294,30 @@
         </div>
     </div>
 
+    <!-- Hysteria Card -->
+    <div class="card card-hover protocol-card protocol-hysteria" id="proto-hysteria">
+        <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
+            <div class="protocol-icon">🌀</div>
+            <div class="flex gap-sm" id="hysteria-ctrl" style="display:none!important;"></div>
+        </div>
+        <div class="protocol-name">Hysteria 2</div>
+        <div class="protocol-desc">
+            {{ _('hysteria_desc') }}
+        </div>
+        <div class="protocol-status" id="hysteria-status">
+            <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
+        </div>
+        <div id="hysteria-info" class="hidden">
+            <div class="protocol-info" id="hysteria-info-grid"></div>
+        </div>
+        <div class="flex gap-sm" id="hysteria-actions">
+            <button class="btn btn-primary btn-sm" onclick="openInstallModal('hysteria')" id="hysteria-install-btn"
+                style="flex:1">
+                {{ _('install') }}
+            </button>
+        </div>
+    </div>
+
     <!-- WireGuard Card -->
     <div class="card card-hover protocol-card protocol-wireguard" id="proto-wireguard">
         <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
@@ -655,6 +679,20 @@
                 <div class="form-hint">{{ _('nginx_install_hint') }}</div>
             </div>
 
+            <div id="hysteriaOptions"
+                style="display:none; padding: var(--space-md); background: rgba(0,0,0,0.03); border-radius: var(--radius-md); margin-bottom: var(--space-md);">
+                <div class="form-group">
+                    <label class="form-label">{{ _('hysteria_domain') }}</label>
+                    <input class="form-input" type="text" id="installHysteriaDomain" placeholder="vpn.example.com" oninput="updateHysteriaDnsHint()">
+                    <div class="form-hint" id="hysteriaDnsHint"></div>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('hysteria_email') }}</label>
+                    <input class="form-input" type="email" id="installHysteriaEmail" placeholder="admin@example.com">
+                </div>
+                <div class="form-hint">{{ _('hysteria_install_hint') }}</div>
+            </div>
+
             <div class="modal-footer">
                 <button class="btn btn-secondary" onclick="closeModal('installModal')">{{ _('cancel') }}</button>
                 <button class="btn btn-primary" onclick="installProtocol()" id="installBtn">
@@ -934,6 +972,7 @@
         { proto: 'awg_legacy', category: 'protocols', icon: '📡', title: 'AmneziaWG Legacy', descKey: 'awg_legacy_desc' },
         { proto: 'xray', category: 'protocols', icon: '⚡', title: 'Xray (VLESS-Reality)', descKey: 'xray_desc' },
         { proto: 'telemt', category: 'protocols', icon: '✈', title: 'Telemt (Telegram Proxy)', descKey: 'telemt_desc' },
+        { proto: 'hysteria', category: 'protocols', icon: '🌀', title: 'Hysteria 2', descKey: 'hysteria_desc' },
         { proto: 'wireguard', category: 'protocols', icon: '🔒', title: 'WireGuard', descKey: 'wireguard_desc' },
         { proto: 'dns', category: 'services', icon: '🔍', title: 'AmneziaDNS', descKey: 'dns_desc' },
         { proto: 'adguard', category: 'services', icon: '🛡️', title: 'AdGuard Home', descKey: 'adguard_desc' },
@@ -969,7 +1008,7 @@
     }
 
     function isMultiInstanceBase(proto) {
-        return ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'socks5'].includes(protoBase(proto));
+        return ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'].includes(protoBase(proto));
     }
 
     function nextSuggestedPort(base, fallback) {
@@ -1174,6 +1213,7 @@
             case 'awg_legacy': title = 'AmneziaWG Legacy'; break;
             case 'xray': title = 'Xray'; break;
             case 'telemt': title = 'Telemt'; break;
+            case 'hysteria': title = 'Hysteria 2'; break;
             case 'wireguard': title = 'WireGuard'; break;
             case 'dns': title = 'AmneziaDNS'; break;
             case 'socks5': title = 'SOCKS5 Proxy'; break;
@@ -1233,7 +1273,7 @@
 
                 for (const [proto, info] of orderedProtocolEntries(data.protocols)) {
                     updateProtocolCard(proto, info);
-                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard'].includes(protoBase(proto));
+                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'wireguard'].includes(protoBase(proto));
                     if (info.container_running && isVPN) {
                         const opt = document.createElement('option');
                         opt.value = proto;
@@ -1462,6 +1502,9 @@
                     grid = buildServiceInfoGrid(proto, info);
                 } else if (info.port) {
                     grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('port')}</span><span class="protocol-info-value">${info.port}/${(['xray', 'telemt'].includes(protoBase(proto))) ? 'TCP' : 'UDP'}</span></div>`;
+                    if (protoBase(proto) === 'hysteria' && info.domain) {
+                        grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('hysteria_domain')}</span><span class="protocol-info-value">${info.domain}</span></div>`;
+                    }
                 }
                 if (!isService && info.clients_count !== undefined) {
                     grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('connections')}</span><span class="protocol-info-value">${info.clients_count}</span></div>`;
@@ -1691,6 +1734,14 @@
         hint.innerHTML = `${_('nginx_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
     }
 
+    function updateHysteriaDnsHint() {
+        const input = document.getElementById('installHysteriaDomain');
+        const hint = document.getElementById('hysteriaDnsHint');
+        if (!input || !hint) return;
+        const domain = (input.value || '').trim() || 'vpn.example.com';
+        hint.innerHTML = `${_('hysteria_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
+    }
+
     function openInstallModal(proto, installAnother = false) {
         const base = protoBase(proto);
         currentInstallProto = installAnother ? base : proto;
@@ -1705,11 +1756,13 @@
         const socks5Opts = document.getElementById('socks5Options');
         const adguardOpts = document.getElementById('adguardOptions');
         const nginxOpts = document.getElementById('nginxOptions');
+        const hysteriaOpts = document.getElementById('hysteriaOptions');
 
         telemtOpts.style.display = 'none';
         socks5Opts.style.display = 'none';
         adguardOpts.style.display = 'none';
         nginxOpts.style.display = 'none';
+        hysteriaOpts.style.display = 'none';
 
         if (base === 'dns') {
             portLabel.textContent = _('port') + ' (Internal)';
@@ -1746,6 +1799,13 @@
             portHint.textContent = _('nginx_port_hint');
             nginxOpts.style.display = 'block';
             updateNginxDnsHint();
+        } else if (base === 'hysteria') {
+            portLabel.textContent = _('port') + ' (UDP)';
+            portInput.value = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 8998) : '8998';
+            portInput.disabled = false;
+            portHint.textContent = currentInstallAnother ? _('port_next_instance_hint') : _('hysteria_port_hint');
+            hysteriaOpts.style.display = 'block';
+            updateHysteriaDnsHint();
         } else {
             portLabel.textContent = _('port') + ' (UDP)';
             portInput.value = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 55424) : '55424';
@@ -1812,6 +1872,9 @@
             } else if (protoBase(currentInstallProto) === 'nginx') {
                 params.nginx_domain = document.getElementById('installNginxDomain').value.trim();
                 params.nginx_email = document.getElementById('installNginxEmail').value.trim();
+            } else if (protoBase(currentInstallProto) === 'hysteria') {
+                params.hysteria_domain = document.getElementById('installHysteriaDomain').value.trim();
+                params.hysteria_email = document.getElementById('installHysteriaEmail').value.trim();
             }
             const result = await apiCall(`/api/servers/${SERVER_ID}/install`, 'POST', params);
             clearInterval(progressInterval);
@@ -2025,7 +2088,7 @@
                 const sent = userData.dataSent || '';
                 const initial = name.charAt(0).toUpperCase();
                 const enabled = (client.enabled !== undefined) ? client.enabled : (userData.enabled !== false);
-                const hasPrivKey = !!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt';
+                const hasPrivKey = !!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt' || protoBase(proto) === 'hysteria';
                 const assignedUser = client.assigned_user || '';
 
                 let metaHtml = '';
@@ -2063,7 +2126,7 @@
                             </div>
                         </div>
                         <div class="client-actions">
-                            <button class="btn btn-secondary btn-sm btn-icon" onclick="showConnectionConfig('${escapeJs(client.clientId)}', '${escapeJs(name)}', ${!!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt'})" title="${_('config')}">📄</button>
+                            <button class="btn btn-secondary btn-sm btn-icon" onclick="showConnectionConfig('${escapeJs(client.clientId)}', '${escapeJs(name)}', ${!!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt' || protoBase(proto) === 'hysteria'})" title="${_('config')}">📄</button>
                             ${proto === 'telemt' ? `<button class="btn btn-secondary btn-sm btn-icon" onclick="editConnection('${escapeJs(client.clientId)}')" title="${_('edit')}">✏️</button>` : ''}
                             <button class="btn btn-secondary btn-sm btn-icon" onclick="toggleConnection('${escapeJs(client.clientId)}', ${!enabled})" title="${toggleTitle}">${toggleIcon}</button>
                             <button class="btn btn-danger btn-sm btn-icon" onclick="removeConnection('${escapeJs(client.clientId)}')" title="${_('delete')}">🗑</button>
@@ -2115,8 +2178,8 @@
                     document.getElementById('configModalTitle').textContent = `${_('config')} — ${connName}`;
                     document.getElementById('configText').textContent = result.config;
                     document.getElementById('vpnLinkText').textContent = currentVpnLink;
-                    document.getElementById('panel-vpn').style.display = (proto === 'telemt' ? 'none' : '');
-                    document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' ? 'none' : '');
+                    document.getElementById('panel-vpn').style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
+                    document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
                     switchConfigTab('conf');
                     openModal('configModal');
                     generateQR(result.config);
@@ -2194,9 +2257,9 @@
         const proto = document.getElementById('connProtoSelect').value;
 
         // Restore tabs visibility first
-        document.getElementById('panel-vpn').style.display = (proto === 'telemt' ? 'none' : '');
+        document.getElementById('panel-vpn').style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
         document.getElementById('panel-qr').style.display = '';
-        document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' ? 'none' : '');
+        document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
         document.querySelectorAll('.config-tab')[2].style.display = '';
 
         // Client was created via native Amnezia app — private key is not stored server-side

templates/settings.html

@@ -115,7 +115,7 @@
                                 {% for s in servers %}
                                 {% set server_idx = loop.index0 %}
                                 {% for key, info in (s.protocols or {}).items() %}
-                                {% if info.installed and key.split('__')[0] in ['awg','awg2','awg_legacy','xray','wireguard','telemt'] %}
+                                {% if info.installed and key.split('__')[0] in ['awg','awg2','awg_legacy','xray','wireguard','telemt','hysteria'] %}
                                 <option value="{{ key }}|{{ server_idx }}"
                                     {% if settings.guest.create_protocol == key and settings.guest.create_server_id == server_idx %}selected{% endif %}>
                                     {{ s.name or s.host }} — {{ key }}

templates/users.html

@@ -596,7 +596,7 @@
         const select = document.getElementById(selectId);
         const group = groupId ? document.getElementById(groupId) : null;
         select.innerHTML = '';
-        const vpnBases = new Set(['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard']);
+        const vpnBases = new Set(['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'wireguard']);
         let count = 0;
 
         const server = (serverId !== '' && serversData[serverId]) ? serversData[serverId] : null;
@@ -608,7 +608,7 @@
             if (!vpnBases.has(base)) continue;
             const opt = document.createElement('option');
             opt.value = key;
-            opt.textContent = key === 'awg' ? 'AmneziaWG' : (key === 'awg2' ? 'AmneziaWG 2.0' : (key === 'awg_legacy' ? 'AWG Legacy' : (key === 'xray' ? 'Xray' : (key === 'wireguard' ? 'WireGuard' : (key === 'telemt' ? 'Telemt' : key.toUpperCase())))));
+            opt.textContent = key === 'awg' ? 'AmneziaWG' : (key === 'awg2' ? 'AmneziaWG 2.0' : (key === 'awg_legacy' ? 'AWG Legacy' : (key === 'xray' ? 'Xray' : (key === 'wireguard' ? 'WireGuard' : (key === 'telemt' ? 'Telemt' : (key === 'hysteria' ? 'Hysteria 2' : key.toUpperCase()))))));
             select.appendChild(opt);
             count++;
         }

translations/en.json

@@ -356,6 +356,12 @@
   "config_unavailable_desc": "This client was created via the native Amnezia app.\\nThe private key is stored only on the user's device and cannot be recovered by the server.",
   "client_public_key": "Client public key:",
   "telemt_desc": "MTProxy-based Telegram proxy with advanced obfuscation and TLS emulation support.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) via teddysun/hysteria with Let's Encrypt TLS. Admin sets the domain at install time.",
+  "hysteria_domain": "Domain",
+  "hysteria_email": "Let's Encrypt email",
+  "hysteria_port_hint": "UDP port for Hysteria (default 8998). Port 80/TCP must be free for certificate issuance.",
+  "hysteria_install_hint": "Point the domain A-record to this server before install. Port 80/TCP is used temporarily for Let's Encrypt HTTP-01 validation.",
+  "hysteria_dns_hint": "Create this DNS record before installation:",
   "tls_emulation": "TLS Emulation",
   "tls_domain": "Masking Domain",
   "max_connections_limit": "Max Connections",

translations/fa.json

@@ -361,6 +361,12 @@
   "clear_server": "پاک‌سازی سرور",
   "remove_server": "حذف سرور از پنل",
   "telemt_desc": "پروکسی تلگرام بر پایه‌ی MTProxy با پوشش‌های پیشرفته.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) با تصویر teddysun/hysteria و TLS از Let's Encrypt. دامنه را ادمین هنگام نصب مشخص می‌کند.",
+  "hysteria_domain": "دامنه",
+  "hysteria_email": "ایمیل Let's Encrypt",
+  "hysteria_port_hint": "پورت UDP برای Hysteria (پیش‌فرض 8998). پورت 80/TCP باید برای صدور گواهی آزاد باشد.",
+  "hysteria_install_hint": "قبل از نصب، رکورد A دامنه باید به این سرور اشاره کند. پورت 80/TCP موقتاً برای اعتبارسنجی HTTP-01 استفاده می‌شود.",
+  "hysteria_dns_hint": "قبل از نصب این رکورد DNS را بسازید:",
   "dns_desc": "سرور DNS شخصی برای مسدود کردن تبلیغات و حفظ حریم خصوصی.",
   "dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
   "telemt_port_hint": "Port for the Telegram proxy (typically 443).",

translations/fr.json

@@ -361,6 +361,12 @@
   "clear_server": "Réinitialiser le serveur",
   "remove_server": "Retirer le serveur du panneau",
   "telemt_desc": "Proxy Telegram basé sur MTProxy avec obfuscation avancée.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) via teddysun/hysteria avec TLS Let's Encrypt. Le domaine est défini par l'admin à l'installation.",
+  "hysteria_domain": "Domaine",
+  "hysteria_email": "Email Let's Encrypt",
+  "hysteria_port_hint": "Port UDP pour Hysteria (8998 par défaut). Le port 80/TCP doit être libre pour le certificat.",
+  "hysteria_install_hint": "L'enregistrement A du domaine doit pointer vers ce serveur. Le port 80/TCP est utilisé temporairement pour la validation HTTP-01 Let's Encrypt.",
+  "hysteria_dns_hint": "Créez cet enregistrement DNS avant l'installation :",
   "dns_desc": "Serveur DNS personnel pour bloquer les publicités et protéger la vie privée.",
   "dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
   "telemt_port_hint": "Port for the Telegram proxy (typically 443).",

translations/ru.json

@@ -356,6 +356,12 @@
   "config_unavailable_desc": "Этот клиент был создан через нативное приложение Amnezia.\\nПриватный ключ хранится только на устройстве пользователя и не может быть восстановлен сервером.",
   "client_public_key": "Публичный ключ клиента:",
   "telemt_desc": "Прокси для Telegram на базе MTProxy с продвинутой обфускацией и эмуляцией TLS.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) на образе teddysun/hysteria с TLS от Let's Encrypt. Домен указывает админ при установке.",
+  "hysteria_domain": "Домен",
+  "hysteria_email": "Email для Let's Encrypt",
+  "hysteria_port_hint": "UDP-порт Hysteria (по умолчанию 8998). Порт 80/TCP должен быть свободен для выпуска сертификата.",
+  "hysteria_install_hint": "Перед установкой A-запись домена должна указывать на этот сервер. Порт 80/TCP временно используется для HTTP-01 проверки Let's Encrypt.",
+  "hysteria_dns_hint": "Перед установкой создайте DNS-запись:",
   "tls_emulation": "TLS-эмуляция",
   "tls_domain": "Домен маскировки",
   "max_connections_limit": "Макс. соединений",

translations/zh.json

@@ -361,6 +361,12 @@
   "clear_server": "清除服务器",
   "remove_server": "从面板移除服务器",
   "telemt_desc": "基于 MTProxy 的 Telegram 代理，支持高级混淆。",
+  "hysteria_desc": "Hysteria 2（QUIC/UDP，teddysun/hysteria），支持 Let's Encrypt TLS。安装时由管理员指定域名。",
+  "hysteria_domain": "域名",
+  "hysteria_email": "Let's Encrypt 邮箱",
+  "hysteria_port_hint": "Hysteria UDP 端口（默认 8998）。签发证书时需要 80/TCP 空闲。",
+  "hysteria_install_hint": "安装前请将域名 A 记录指向本服务器。80/TCP 会临时用于 Let's Encrypt HTTP-01 验证。",
+  "hysteria_dns_hint": "安装前请创建此 DNS 记录：",
   "dns_desc": "防止广告和保护隐私的个人 DNS 服务器。",
   "dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
   "telemt_port_hint": "Port for the Telegram proxy (typically 443).",