Add one-click panel auto-update from git.evilfox.cc (v2.4.0).

Check Gitea releases in Settings and install the latest tag via git fetch/checkout with pip sync and restart when running from a git checkout.

README.md

@@ -1,6 +1,6 @@
 # Amnezia Web Panel
 
-A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
+A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Hysteria 2**, **NaiveProxy**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
 
 > ### 🔄 Compatibility with Official Amnezia Client
 > 
@@ -62,6 +62,8 @@ Configuration panel for system parameters and preferences:
     *   **AmneziaWG (AWG / AWG 2.0 / AWG Legacy)**: Advanced WireGuard-based protocol with S3/S4 obfuscation to bypass deep packet inspection (DPI). Three coexisting variants — modern AWG 2.0 with full junk-packet masking, and a legacy variant for older clients.
     *   **Classic WireGuard**: Standard, high-performance WireGuard protocol for unmatched speed and broad device compatibility with traffic monitoring support.
     *   **Xray (XTLS-Reality)**: Stealthy protocol that masks VPN traffic as standard HTTPS browsing. Pinned to **Xray-core v26.x**; transparently reads both the **panel layout** (`meta.json` + `clientsTable.json`) and the **native Amnezia client layout** (`xray_*.key` files + `clientsTable`), so a node first installed via the official mobile/desktop app can be attached to the panel without re-installation.
+    *   **Hysteria 2**: QUIC/HTTP3 proxy from [apernet/hysteria](https://github.com/apernet/hysteria) via `tobyxdd/hysteria:v2` — Let's Encrypt TLS, salamander obfuscation, password auth, `hy2://` share links. Per-server SSL domain/email defaults, renew from settings; install requires free TCP **80** and **443**.
+    *   **NaiveProxy** (stable): HTTPS/HTTP2 camouflage proxy via [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) (Caddy + [klzgrad/forwardproxy](https://github.com/klzgrad/forwardproxy) naïve fork). ACME TLS on the domain, per-client basic auth, `naive+https://` share links. Requires free TCP **80** and **443**. **Use Karing** as the client — do **not** use v2rayN; other clients are untested.
     *   **Telemt (Telegram MTProxy)**: High-performance Telegram MTProxy with TLS emulation and comprehensive management (quotas, IP limits, real-time session tracking). Robust install path that auto-configures Docker's official apt/yum repository when needed.
     *   **Cloudflare WARP**: Add and manage WARP-powered connectivity from the panel for routing and network flexibility.
 *   **🛠 Services**:
@@ -71,17 +73,20 @@ Configuration panel for system parameters and preferences:
     *   **NGINX + Let's Encrypt**: Reverse-proxy and HTTPS automation with certificate management for secure public endpoints.
 *   **⚙️ Core Server Management**:
     *   **Add / Edit / Delete / Reorder** server entries — drag-and-drop reorder updates `server_id` references in saved connections automatically.
+    *   **Per-server SSL defaults**: optional domain + Let's Encrypt email on each server, pre-filled when installing Hysteria or NGINX.
     *   **Live ping indicator** next to each server name — non-blocking TCP-connect probe to the SSH port, runs on the asyncio loop in parallel for all servers.
     *   **Clear server** wipes every Amnezia-related container, image and `/opt/amnezia` directory in a single sudo script — works for any current or future `amnezia-*` protocol.
     *   **Reboot** the server directly from the UI.
     *   Strictly concurrent protocol status polling — all supported protocols/services checked in parallel for immediate feedback.
     *   **Asynchronous Processing**: Resilient, non-blocking background architecture prevents the UI panel from freezing, even if remote endpoints hang.
 *   **🧩 Marketplace & Templates**:
-    *   Market templates provide quick presets for installing and configuring supported protocols and services.
+    *   Market templates provide quick presets for installing and configuring supported protocols and services (including **Hysteria 2**).
     *   Multi-protocol management lets you run and control multiple protocol instances on the same server.
 *   **🌐 Internationalization (i18n)**:
     *   Full support for **English**, **Russian**, **French**, **Chinese**, and **Persian**.
     *   Native **RTL (Right-to-Left)** support for Persian language.
+*   **🔄 Auto-update**:
+    *   Settings → About checks releases on [git.evilfox.cc](https://git.evilfox.cc/test2/Amnezia-Web-Panel-main) and can install the latest tag via git + restart (when the panel runs from a git checkout).
 *   **👥 Advanced User Management**:
     *   Role-based access (Admin, Support, Regular User).
     *   Traffic limits, status monitoring, and account expiration.
@@ -219,16 +224,57 @@ GitHub Actions workflows in `.github/workflows/`:
 
 ## 📋 Fix / changelog (this fork)
 
+### v2.4.0
+*   **Auto-update from Gitea**: Settings → About checks https://git.evilfox.cc/test2/Amnezia-Web-Panel-main releases and can install the latest tag via `git fetch` + checkout, then restart (git install only).
+
+### v2.3.0
+*   **Cascade removed** — double-VPN feature dropped from the panel (manager, API, UI, i18n).
+
+### v2.2.1
+*   **Cascade egress verify fix**: bind curl to ENTRY `awg0`/`wg0` IP (client-subnet policy route), not cascade peer Address.
+*   Soft-warn (no rollback) when policy route via `cascade` is OK but public-IP echo services fail.
+
+### v2.2.0
+*   **Cascade (double VPN) restored** — later removed in **v2.3.0**.
+*   Inspired by [ryderams/amneziawg-cascade](https://github.com/ryderams/amneziawg-cascade); logic ran over panel SSH (**no remote curl|bash**).
+
+### v2.1.0
+*   **NaiveProxy — stable**: production-ready install (Caddy + klzgrad/forwardproxy), share links always include `:443`.
+*   **Client notes (important)**:
+    *   **Do not use v2rayN** with NaiveProxy (broken DNS/IPv6 behaviour → latency −1 ms even when the server is fine).
+    *   **Karing** — confirmed working.
+    *   Other clients — untested / use at your own risk.
+*   Share-link and config UI hints updated accordingly.
+
+### v2.0.0-beta
+*   **NaiveProxy** (Beta): install [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) server via Caddy + naïve [forwardproxy](https://github.com/klzgrad/forwardproxy) — domain TLS (ACME), per-client basic auth, `naive+https://` share links.
+*   Marketplace / server page / users / invites / Telegram / backups include NaiveProxy.
+*   Install warns that free TCP **80** and **443** are required; uses per-server SSL domain/email defaults when set.
+*   Official prebuilt Caddy on amd64; xcaddy build path for other arches.
+*   Version line bumped to **2.0 Beta** (`v2.0.0-beta`).
+
+### v1.8.0
+*   **Hysteria 2** fully wired in marketplace, server page, users/invites, Telegram bot, and backups.
+*   **Per-server SSL defaults**: set domain + Let's Encrypt email when adding/editing a server; values pre-fill Hysteria (and NGINX) install forms.
+*   **SSL renew**: change domain or use “Renew SSL” in Hysteria settings to re-issue the certificate (needs free TCP 80).
+*   **Install warning**: free TCP ports **80** and **443** required for stable Let's Encrypt / HTTPS-QUIC operation.
+*   Official image `tobyxdd/hysteria:v2`, salamander obfs, password auth, `hy2://` share links, selectable UDP listen port.
+
+### v1.7.0
+*   **Clearer create flow**: pick **server first**, then **protocol** (WireGuard, AmneziaWG 2.0, …) — invites, guest access, and user connections no longer dump everything into one messy list.
+*   Protocol titles are human-readable and ordered (AWG 2.0 → AWG → Legacy → WireGuard → Xray → Telemt → Hysteria).
+*   3x-ui is a separate “server” choice; VLESS inbounds still load from that panel’s API.
+*   **Hysteria 2** manager restored ([apernet/hysteria](https://github.com/apernet/hysteria)) — see **v1.8.0** for full panel integration.
+
 ### v1.6.0
 *   **3x-ui multi-panel**: register several 3x-ui servers in Settings; pick a panel and load VLESS inbounds over its API when creating users/invites (share link comes from 3x-ui).
 *   **Docker / CI**: refreshed `Dockerfile` + compose, `.env.example`, CI checks, GHCR image workflow.
-*   **Cascade removed** for now (pending redesign — showed active while internet often did not work).
+*   **Cascade** was temporarily removed in this release (briefly restored in v2.2.x, removed again in **v2.3.0**).
 *   **WG/AWG backups**: ZIP export of client `.conf` + restore with loading feedback.
 *   **API performance**: in-memory data cache, faster server check/stats.
 *   **Share / guest**: one-tap “Copy key”.
 *   **User expiration**: countdown can start on first config use; UTC-safe comparisons.
 *   **UI**: shared SVG icon system.
-*   **Removed earlier**: Hysteria 2.
 
 ## 🔧 Project Details
 
@@ -290,6 +336,8 @@ web-panel/
 │   ├── awg_manager.py        # AmneziaWG / AWG 2.0 / AWG Legacy
 │   ├── wireguard_manager.py  # Classic WireGuard
 │   ├── xray_manager.py       # Xray-core (VLESS-Reality)
+│   ├── hysteria_manager.py   # Hysteria 2 (apernet/hysteria)
+│   ├── naiveproxy_manager.py # NaiveProxy (Caddy + klzgrad/forwardproxy)
 │   ├── telemt_manager.py     # Telegram MTProxy
 │   ├── dns_manager.py        # AmneziaDNS (Unbound)
 │   ├── adguard_manager.py    # AdGuard Home

app.py

@@ -46,6 +46,7 @@ from managers.awg_manager import AWGManager
 from managers.xray_manager import XrayManager
 from managers.wireguard_manager import WireGuardManager
 from managers.backup_manager import BackupManager
+from managers.update_manager import UpdateManager, version_gt, api_latest_url, repo_url
 import telegram_bot as tg_bot
 
 # Configure logging
@@ -101,7 +102,9 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v1.6.0"
+CURRENT_VERSION = "v2.4.0"
+RELEASES_REPO_URL = repo_url()
+RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
 TUNNEL_STATE_FILE = os.environ.get('TUNNEL_STATE_FILE', os.path.join(application_path, 'tunnels_state.json'))
 
@@ -149,7 +152,7 @@ def load_translations():
             if f.endswith('.json'):
                 lang = f.split('.')[0]
                 try:
-                    with open(os.path.join(trans_dir, f), 'r', encoding='utf-8') as tf:
+                    with open(os.path.join(trans_dir, f), 'r', encoding='utf-8-sig') as tf:
                         TRANSLATIONS[lang] = json.load(tf)
                 except Exception as e:
                     logger.error(f"Error loading translation {f}: {e}")
@@ -841,8 +844,8 @@ async def wait_for_tunnel_url(provider: str, seconds: int = 20):
     return get_tunnel_status(provider)
 
 
-BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
-MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'socks5'}
+BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
+MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'}
 
 
 def protocol_base(protocol: str) -> str:
@@ -882,6 +885,8 @@ def protocol_display_name(protocol: str) -> str:
         'awg_legacy': 'AmneziaWG Legacy',
         'xray': 'Xray',
         'telemt': 'Telemt',
+        'hysteria': 'Hysteria 2',
+        'naiveproxy': 'NaiveProxy',
         'dns': 'AmneziaDNS',
         'wireguard': 'WireGuard',
         'socks5': 'SOCKS5',
@@ -901,6 +906,8 @@ def protocol_container_name(protocol: str) -> Optional[str]:
         'awg_legacy': 'amnezia-awg-legacy',
         'xray': 'amnezia-xray',
         'telemt': 'telemt',
+        'hysteria': 'amnezia-hysteria',
+        'naiveproxy': 'amnezia-naiveproxy',
         'dns': 'amnezia-dns',
         'wireguard': 'amnezia-wireguard',
         'socks5': 'amnezia-socks5proxy',
@@ -940,6 +947,12 @@ def get_protocol_manager(ssh, protocol: str):
     elif base == 'nginx':
         from managers.nginx_manager import NginxManager
         return NginxManager(ssh, protocol)
+    elif base == 'hysteria':
+        from managers.hysteria_manager import HysteriaManager
+        return HysteriaManager(ssh, protocol)
+    elif base == 'naiveproxy':
+        from managers.naiveproxy_manager import NaiveProxyManager
+        return NaiveProxyManager(ssh, protocol)
     from managers.awg_manager import AWGManager
     return AWGManager(ssh)
 
@@ -1001,7 +1014,7 @@ def _manager_call(manager, method, protocol, *args, **kwargs):
 
 
 # Protocols that own VPN clients (can list/link connections)
-CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'xui'}
+CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'hysteria', 'naiveproxy', 'xui'}
 
 
 def generate_vpn_link(config_text):
@@ -1663,6 +1676,8 @@ class AddServerRequest(BaseModel):
     password: str = ''
     private_key: str = ''
     name: str = ''
+    ssl_domain: str = ''
+    ssl_email: str = ''
 
 
 class EditServerRequest(BaseModel):
@@ -1675,6 +1690,8 @@ class EditServerRequest(BaseModel):
     # fields can be omitted to keep current auth unchanged.
     password: Optional[str] = None
     private_key: Optional[str] = None
+    ssl_domain: Optional[str] = None
+    ssl_email: Optional[str] = None
 
 
 class ReorderServersRequest(BaseModel):
@@ -1704,6 +1721,12 @@ class InstallProtocolRequest(BaseModel):
     # NGINX
     nginx_domain: Optional[str] = None
     nginx_email: Optional[str] = None
+    # Hysteria
+    hysteria_domain: Optional[str] = None
+    hysteria_email: Optional[str] = None
+    # NaiveProxy
+    naiveproxy_domain: Optional[str] = None
+    naiveproxy_email: Optional[str] = None
 
 
 class Socks5SettingsRequest(BaseModel):
@@ -1713,6 +1736,13 @@ class Socks5SettingsRequest(BaseModel):
     password: Optional[str] = None
 
 
+class HysteriaSettingsRequest(BaseModel):
+    protocol: str = 'hysteria'
+    port: Optional[int] = None
+    domain: Optional[str] = None
+    email: Optional[str] = None
+    renew_ssl: bool = False
+
 class ProtocolRequest(BaseModel):
     protocol: str = 'awg'
 
@@ -1963,6 +1993,11 @@ class TunnelStartRequest(BaseModel):
     authtoken: Optional[str] = None
 
 
+class ApplyUpdateRequest(BaseModel):
+    target_version: Optional[str] = None
+    allow_dirty: bool = False
+
+
 # ======================== Startup ========================
 
 @app.on_event("startup")
@@ -2270,7 +2305,7 @@ async def server_detail(request: Request, server_id: int):
         return RedirectResponse(url='/')
     server = data['servers'][server_id]
     users_list = data.get('users', [])
-    return tpl(request, 'server.html', server=server, server_id=server_id, users=users_list, all_servers=data['servers'])
+    return tpl(request, 'server.html', server=server, server_id=server_id, users=users_list)
 
 
 @app.get('/users', response_class=HTMLResponse, tags=["System Templates"])
@@ -2431,6 +2466,13 @@ async def api_add_server(request: Request, req: AddServerRequest):
             'private_key': req.private_key, 'server_info': server_info,
             'protocols': {},
         }
+        ssl_domain = (req.ssl_domain or '').strip().lower()
+        ssl_email = (req.ssl_email or '').strip()
+        if ssl_domain:
+            server_info['ssl_domain'] = ssl_domain
+        if ssl_email:
+            server_info['ssl_email'] = ssl_email
+        server['server_info'] = server_info
         data = load_data()
         data['servers'].append(server)
         save_data(data)
@@ -2491,9 +2533,27 @@ async def api_edit_server(request: Request, server_id: int, req: EditServerReque
         server['username'] = new_user
         server['password'] = new_pass
         server['private_key'] = new_key
-        server['server_info'] = server_info
+        # Merge SSH probe info with preserved SSL domain defaults
+        info = dict(server.get('server_info') or {})
+        if isinstance(server_info, dict):
+            for k, v in server_info.items():
+                if k not in ('ssl_domain', 'ssl_email'):
+                    info[k] = v
+        if req.ssl_domain is not None:
+            domain = (req.ssl_domain or '').strip().lower()
+            if domain:
+                info['ssl_domain'] = domain
+            else:
+                info.pop('ssl_domain', None)
+        if req.ssl_email is not None:
+            email = (req.ssl_email or '').strip()
+            if email:
+                info['ssl_email'] = email
+            else:
+                info.pop('ssl_email', None)
+        server['server_info'] = info
         save_data(data)
-        return {'status': 'success', 'server_info': server_info}
+        return {'status': 'success', 'server_info': info}
     except Exception as e:
         logger.exception("Error editing server")
         return JSONResponse({'error': str(e)}, status_code=500)
@@ -2799,6 +2859,18 @@ async def api_check_server(request: Request, server_id: int):
                         for key in ('domain', 'email', 'site_url'):
                             if db_proto.get(key) not in (None, ''):
                                 merged[key] = db_proto[key]
+                    if protocol_base(proto) == 'hysteria':
+                        for key in ('domain', 'email'):
+                            if db_proto.get(key) not in (None, '') and not merged.get(key):
+                                merged[key] = db_proto[key]
+                        if db_proto.get('port') and not merged.get('port'):
+                            merged['port'] = db_proto['port']
+                    if protocol_base(proto) == 'naiveproxy':
+                        for key in ('domain', 'email'):
+                            if db_proto.get(key) not in (None, '') and not merged.get(key):
+                                merged[key] = db_proto[key]
+                        if db_proto.get('port') and not merged.get('port'):
+                            merged['port'] = db_proto['port']
                     return merged
 
                 def should_preserve_saved_protocol(proto, result=None, err=None):
@@ -2950,6 +3022,20 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
                 domain=req.nginx_domain,
                 email=req.nginx_email,
             )
+        elif install_base == 'hysteria':
+            result = manager.install_protocol(
+                protocol_type=install_protocol,
+                port=req.port,
+                domain=req.hysteria_domain,
+                email=req.hysteria_email,
+            )
+        elif install_base == 'naiveproxy':
+            result = manager.install_protocol(
+                protocol_type=install_protocol,
+                port=req.port,
+                domain=req.naiveproxy_domain,
+                email=req.naiveproxy_email,
+            )
         else:
             result = manager.install_protocol(install_protocol, port=req.port)
 
@@ -2976,6 +3062,29 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
             proto_record['domain'] = result.get('domain')
             proto_record['email'] = result.get('email')
             proto_record['site_url'] = result.get('site_url')
+        if install_base == 'hysteria':
+            # Remember domain/email as server defaults for next installs / renewals
+            info = server.setdefault('server_info', {})
+            if req.hysteria_domain:
+                info['ssl_domain'] = (req.hysteria_domain or '').strip().lower()
+            if req.hysteria_email:
+                info['ssl_email'] = (req.hysteria_email or '').strip()
+            save_data(data)
+            proto_record['domain'] = result.get('domain')
+            proto_record['email'] = result.get('email')
+            if result.get('port'):
+                proto_record['port'] = str(result['port'])
+        if install_base == 'naiveproxy':
+            info = server.setdefault('server_info', {})
+            if req.naiveproxy_domain:
+                info['ssl_domain'] = (req.naiveproxy_domain or '').strip().lower()
+            if req.naiveproxy_email:
+                info['ssl_email'] = (req.naiveproxy_email or '').strip()
+            save_data(data)
+            proto_record['domain'] = result.get('domain')
+            proto_record['email'] = result.get('email')
+            if result.get('port'):
+                proto_record['port'] = str(result['port'])
         proto_record['base_protocol'] = install_base
         proto_record['instance'] = protocol_instance(install_protocol)
         proto_record['display_name'] = protocol_display_name(install_protocol)
@@ -3051,6 +3160,83 @@ async def api_socks5_update_credentials(request: Request, server_id: int, req: S
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+@app.get('/api/servers/{server_id}/hysteria/settings', tags=["Protocols"])
+async def api_hysteria_get_settings(request: Request, server_id: int, protocol: str = 'hysteria'):
+    """Return current Hysteria domain/port for the settings modal."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        data = load_data()
+        if server_id >= len(data['servers']):
+            return JSONResponse({'error': 'Server not found'}, status_code=404)
+        if not is_valid_protocol(protocol) or protocol_base(protocol) != 'hysteria':
+            return JSONResponse({'error': 'Invalid protocol'}, status_code=400)
+        server = data['servers'][server_id]
+        ssh = get_ssh(server)
+        ssh.connect()
+        manager = get_protocol_manager(ssh, protocol)
+        settings = manager.get_settings()
+        ssh.disconnect()
+        saved = (server.get('protocols') or {}).get(protocol) or {}
+        if not settings.get('port') and saved.get('port'):
+            settings['port'] = int(saved['port'])
+        return {'status': 'success', **settings}
+    except Exception as e:
+        logger.exception("Error reading Hysteria settings")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
+@app.post('/api/servers/{server_id}/hysteria/settings', tags=["Protocols"])
+async def api_hysteria_update_settings(request: Request, server_id: int, req: HysteriaSettingsRequest):
+    """Change Hysteria UDP listen port and recreate the container."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        data = load_data()
+        if server_id >= len(data['servers']):
+            return JSONResponse({'error': 'Server not found'}, status_code=404)
+        protocol = req.protocol if is_valid_protocol(req.protocol) and protocol_base(req.protocol) == 'hysteria' else 'hysteria'
+        server = data['servers'][server_id]
+        ssh = get_ssh(server)
+        ssh.connect()
+        manager = get_protocol_manager(ssh, protocol)
+        result = manager.update_settings(
+            port=req.port,
+            domain=req.domain,
+            email=req.email,
+            renew_ssl=bool(req.renew_ssl),
+        )
+        ssh.disconnect()
+        if result.get('status') == 'error':
+            return JSONResponse(
+                {'error': result.get('message') or 'Failed to update settings', **{k: v for k, v in result.items() if k != 'status'}},
+                status_code=400,
+            )
+        if result.get('port') or result.get('domain'):
+            srv_proto = server.setdefault('protocols', {}).setdefault(protocol, {})
+            if result.get('port'):
+                srv_proto['port'] = str(result['port'])
+            srv_proto['installed'] = True
+            srv_proto['base_protocol'] = protocol_base(protocol)
+            srv_proto['instance'] = protocol_instance(protocol)
+            srv_proto['display_name'] = protocol_display_name(protocol)
+            srv_proto['container_name'] = protocol_container_name(protocol)
+            if result.get('domain'):
+                srv_proto['domain'] = result['domain']
+            # Keep server-level SSL defaults in sync
+            info = server.setdefault('server_info', {})
+            if result.get('domain'):
+                info['ssl_domain'] = result['domain']
+            if result.get('email'):
+                info['ssl_email'] = result['email']
+            save_data(data)
+        return result
+    except Exception as e:
+        logger.exception("Error updating Hysteria settings")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
+
 @app.post('/api/servers/{server_id}/uninstall', tags=["Protocols"])
 async def api_uninstall_protocol(request: Request, server_id: int, req: ProtocolRequest):
     if not _check_admin(request):
@@ -3084,6 +3270,8 @@ CONTAINER_NAMES = {
     'awg_legacy': 'amnezia-awg-legacy',
     'xray': 'amnezia-xray',
     'telemt': 'telemt',
+    'hysteria': 'amnezia-hysteria',
+    'naiveproxy': 'amnezia-naiveproxy',
     'dns': 'amnezia-dns',
     'wireguard': 'amnezia-wireguard',
     'socks5': 'amnezia-socks5proxy',
@@ -3389,14 +3577,40 @@ async def api_container_toggle(request: Request, server_id: int, req: ProtocolRe
         if is_running:
             ssh.run_sudo_command(f"docker stop {container}")
             action = 'stopped'
+        else:
+            if protocol_base(req.protocol) == 'hysteria':
+                from managers.hysteria_manager import HysteriaManager
+                mgr = HysteriaManager(ssh, req.protocol)
+                meta = mgr._read_metadata()
+                port = int(meta.get('port') or mgr.DEFAULT_PORT)
+                mgr._write_config_from_clients(port)
+                mgr._start_container(port)
             else:
                 ssh.run_sudo_command(f"docker start {container}")
             action = 'started'
+        error = ''
+        recent_logs = ''
+        if protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            diag = mgr.get_container_diagnostics(req.protocol)
+            error = diag.get('error_summary') or ''
+            recent_logs = diag.get('recent_logs') or ''
+            if action == 'started' and not diag.get('running'):
+                ssh.disconnect()
+                return JSONResponse({
+                    'error': error or 'Hysteria failed to start',
+                    'action': action,
+                    'container': container,
+                    'recent_logs': recent_logs,
+                }, status_code=400)
         ssh.disconnect()
         return {
             'status': 'success',
             'action': action,
             'container': container,
+            'error': error,
+            'recent_logs': recent_logs,
         }
     except Exception as e:
         logger.exception("Error toggling container")
@@ -3418,7 +3632,22 @@ async def api_container_logs(request: Request, server_id: int, req: ContainerLog
         container = protocol_container_name(req.protocol)
         ssh = get_ssh(server)
         ssh.connect()
-        # Generic docker logs for all protocols
+        if protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            logs = mgr.get_logs(req.protocol, tail=req.tail or 200)
+            diag = mgr.get_container_diagnostics(req.protocol)
+            ssh.disconnect()
+            return {
+                'status': 'success',
+                'protocol': req.protocol,
+                'container': container,
+                'logs': logs,
+                'running': bool(diag.get('running')),
+                'error': diag.get('error_summary') or '',
+                'exit_code': diag.get('exit_code'),
+                'container_status': diag.get('status') or '',
+            }
         tail = max(20, min(int(req.tail or 200), 2000))
         out, err, _ = ssh.run_sudo_command(
             f"docker logs --tail {tail} --timestamps {shlex.quote(container)} 2>&1",
@@ -3539,6 +3768,14 @@ async def api_server_config(request: Request, server_id: int, req: ProtocolReque
             from managers.nginx_manager import NginxManager
             mgr = NginxManager(ssh, req.protocol)
             config = mgr._get_server_config(req.protocol)
+        elif protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            config = mgr.get_server_config(req.protocol)
+        elif protocol_base(req.protocol) == 'naiveproxy':
+            from managers.naiveproxy_manager import NaiveProxyManager
+            mgr = NaiveProxyManager(ssh, req.protocol)
+            config = mgr.get_server_config(req.protocol)
         else:
             mgr = AWGManager(ssh)
             config = mgr._get_server_config(req.protocol)
@@ -3583,6 +3820,14 @@ async def api_server_config_save(request: Request, server_id: int, req: ServerCo
             from managers.nginx_manager import NginxManager
             mgr = NginxManager(ssh, req.protocol)
             mgr.save_server_config(req.protocol, req.config)
+        elif protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            mgr.save_server_config(req.protocol, req.config)
+        elif protocol_base(req.protocol) == 'naiveproxy':
+            from managers.naiveproxy_manager import NaiveProxyManager
+            mgr = NaiveProxyManager(ssh, req.protocol)
+            mgr.save_server_config(req.protocol, req.config)
         else:
             mgr = AWGManager(ssh)
             mgr.save_server_config(req.protocol, req.config)
@@ -5253,6 +5498,82 @@ async def api_get_settings(request: Request):
     return data.get('settings', {})
 
 
+@app.get('/api/settings/check_updates', tags=["Settings"])
+async def api_check_updates(request: Request):
+    """Proxy latest release lookup to avoid browser CORS blocks on git.evilfox.cc."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        updater = UpdateManager(application_path, CURRENT_VERSION)
+        mode = updater.detect_mode()
+        async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+            resp = await client.get(
+                RELEASES_API_LATEST,
+                headers={'Accept': 'application/json'},
+            )
+        if resp.status_code >= 400:
+            return JSONResponse(
+                {'error': f'Release API returned HTTP {resp.status_code}'},
+                status_code=502,
+            )
+        data = resp.json() if resp.content else {}
+        latest = (data.get('tag_name') or data.get('name') or '').strip()
+        html_url = (data.get('html_url') or f'{RELEASES_REPO_URL}/releases').strip()
+        body = (data.get('body') or '')[:4000]
+        current = CURRENT_VERSION
+        update_available = bool(latest) and version_gt(latest, current)
+        return {
+            'current_version': current,
+            'latest_version': latest,
+            'update_available': update_available,
+            'html_url': html_url,
+            'releases_url': f'{RELEASES_REPO_URL}/releases',
+            'body': body,
+            'can_auto_update': bool(mode.get('can_auto_update')),
+            'update_mode': mode.get('mode'),
+            'mode': mode,
+        }
+    except Exception as e:
+        logger.exception('Error checking for updates')
+        return JSONResponse({'error': str(e)}, status_code=502)
+
+
+@app.post('/api/settings/apply_update', tags=["Settings"])
+async def api_apply_update(request: Request, req: ApplyUpdateRequest):
+    """Pull the selected release tag from git.evilfox.cc and restart the panel."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    updater = UpdateManager(application_path, CURRENT_VERSION)
+    target = (req.target_version or '').strip()
+    if not target:
+        # Resolve latest if UI did not pass a tag
+        try:
+            async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+                resp = await client.get(
+                    RELEASES_API_LATEST,
+                    headers={'Accept': 'application/json'},
+                )
+            if resp.status_code < 400 and resp.content:
+                payload = resp.json()
+                target = (payload.get('tag_name') or payload.get('name') or '').strip()
+        except Exception:
+            logger.exception('Failed to resolve latest tag for apply_update')
+    if not target:
+        return JSONResponse({'error': 'No target version specified'}, status_code=400)
+
+    result = await asyncio.to_thread(
+        updater.apply_update,
+        target,
+        bool(req.allow_dirty),
+    )
+    if result.get('status') != 'success':
+        return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=500)
+
+    if result.get('restart'):
+        UpdateManager.schedule_restart(1.5)
+    return result
+
+
 @app.get('/api/settings/tunnels/status', tags=["Settings"])
 async def api_tunnels_status(request: Request):
     if not _check_admin(request):

managers/backup_manager.py

@@ -62,6 +62,14 @@ class BackupManager:
             remote_dir = inst_path('/opt/amnezia/telemt')
             paths['host'] = [remote_dir]
             paths['container'] = [remote_dir]
+        elif base == 'hysteria':
+            remote_dir = inst_path('/opt/amnezia/hysteria')
+            paths['host'] = [remote_dir]
+            paths['container'] = ['/etc/hysteria']
+        elif base == 'naiveproxy':
+            remote_dir = inst_path('/opt/amnezia/naiveproxy')
+            paths['host'] = [remote_dir]
+            paths['container'] = ['/etc/caddy']
         elif base == 'dns':
             paths['host'] = ['/opt/amnezia/dns']
             paths['container'] = ['/opt/amnezia/dns']

managers/hysteria_manager.py

@@ -0,0 +1,744 @@
+"""
+Hysteria 2 protocol manager — official tobyxdd/hysteria image (apernet/hysteria).
+
+Installs Hysteria with Let's Encrypt TLS for an admin-provided domain
+(certbot standalone on port 80), host networking, BBR, and salamander obfs.
+Clients use password auth (Happ/INCY-compatible); share links are hy2:// URIs.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+import secrets
+import shlex
+import string
+import time
+from urllib.parse import quote
+
+logger = logging.getLogger(__name__)
+
+
+def _q(value):
+    return shlex.quote(str(value))
+
+
+def _rand_token(length=16):
+    alphabet = string.ascii_lowercase + string.digits
+    return ''.join(secrets.choice(alphabet) for _ in range(length))
+
+
+class HysteriaManager:
+    PROTOCOL = 'hysteria'
+    CONTAINER_NAME = 'amnezia-hysteria'
+    IMAGE_NAME = 'tobyxdd/hysteria:v2'
+    CERTBOT_IMAGE = 'certbot/certbot:latest'
+    BASE_DIR = '/opt/amnezia/hysteria'
+    DEFAULT_PORT = 8998
+
+    def __init__(self, ssh, protocol='hysteria'):
+        self.ssh = ssh
+        self.protocol = protocol or self.PROTOCOL
+        self.instance = self._instance_index(self.protocol)
+        self.container_name = self._container_name(self.protocol)
+        self.base_dir = self._base_dir(self.protocol)
+        self.config_path = f'{self.base_dir}/server.yaml'
+        self.clients_path = f'{self.base_dir}/clients.json'
+        self.meta_path = f'{self.base_dir}/metadata.json'
+        self.cert_path = f'{self.base_dir}/cert.crt'
+        self.key_path = f'{self.base_dir}/private.key'
+        self.letsencrypt_dir = f'{self.base_dir}/letsencrypt'
+
+    def _instance_index(self, protocol=None):
+        parts = str(protocol or self.protocol or '').split('__', 1)
+        if len(parts) == 2:
+            try:
+                return max(1, int(parts[1]))
+            except ValueError:
+                return 1
+        return 1
+
+    def _container_name(self, protocol=None):
+        idx = self._instance_index(protocol or self.protocol)
+        return self.CONTAINER_NAME if idx <= 1 else f'{self.CONTAINER_NAME}-{idx}'
+
+    def _base_dir(self, protocol=None):
+        idx = self._instance_index(protocol or self.protocol)
+        return self.BASE_DIR if idx <= 1 else f'{self.BASE_DIR}-{idx}'
+
+    # ===================== STATUS =====================
+
+    def check_docker_installed(self):
+        out, _, code = self.ssh.run_command("docker --version 2>/dev/null")
+        if code != 0:
+            return False
+        out2, _, _ = self.ssh.run_command(
+            "systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
+        )
+        return 'active' in out2 or 'running' in out2.lower()
+
+    def check_protocol_installed(self, protocol_type=None):
+        name = self._container_name(protocol_type or self.protocol)
+        out, _, _ = self.ssh.run_sudo_command(
+            f"docker ps -a --filter name=^{name}$ --format '{{{{.Names}}}}'"
+        )
+        return name in out.strip().split('\n')
+
+    def check_container_running(self, protocol_type=None):
+        name = self._container_name(protocol_type or self.protocol)
+        out, _, _ = self.ssh.run_sudo_command(
+            f"docker ps --filter name=^{name}$ --format '{{{{.Status}}}}'"
+        )
+        return 'Up' in out
+
+    def get_logs(self, protocol_type=None, tail=200):
+        """Return recent docker logs for the Hysteria container."""
+        name = self._container_name(protocol_type or self.protocol)
+        tail = max(20, min(int(tail or 200), 2000))
+        out, err, code = self.ssh.run_sudo_command(
+            f"docker logs --tail {tail} --timestamps {name} 2>&1",
+            timeout=30,
+        )
+        text = (out or err or '').strip()
+        if code != 0 and not text:
+            text = f'(no logs: exit {code})'
+        return text
+
+    def get_container_diagnostics(self, protocol_type=None):
+        """Inspect why the container is stopped / unhealthy."""
+        name = self._container_name(protocol_type or self.protocol)
+        fmt = (
+            '{{.State.Status}}|{{.State.Running}}|{{.State.ExitCode}}|'
+            '{{.State.OOMKilled}}|{{.State.Error}}|{{.State.FinishedAt}}|'
+            '{{.State.StartedAt}}'
+        )
+        out, _, code = self.ssh.run_sudo_command(
+            f"docker inspect -f '{fmt}' {name} 2>/dev/null"
+        )
+        diag = {
+            'status': 'unknown',
+            'running': False,
+            'exit_code': None,
+            'oom_killed': False,
+            'error': '',
+            'finished_at': '',
+            'started_at': '',
+            'recent_logs': '',
+            'error_summary': '',
+        }
+        if code != 0 or not (out or '').strip():
+            diag['status'] = 'missing'
+            diag['error_summary'] = 'Container not found'
+            return diag
+
+        parts = (out or '').strip().split('|')
+        while len(parts) < 7:
+            parts.append('')
+        status, running, exit_code, oom, err, finished, started = parts[:7]
+        diag['status'] = status or 'unknown'
+        diag['running'] = str(running).lower() == 'true'
+        try:
+            diag['exit_code'] = int(exit_code)
+        except Exception:
+            diag['exit_code'] = None
+        diag['oom_killed'] = str(oom).lower() == 'true'
+        diag['error'] = (err or '').strip()
+        diag['finished_at'] = (finished or '').strip()
+        diag['started_at'] = (started or '').strip()
+        diag['recent_logs'] = self.get_logs(protocol_type, tail=40)
+
+        # Build human-readable summary for the UI badge
+        if diag['running']:
+            diag['error_summary'] = ''
+        elif diag['oom_killed']:
+            diag['error_summary'] = 'OOM killed (out of memory)'
+        elif diag['error']:
+            diag['error_summary'] = diag['error']
+        elif diag['exit_code'] not in (None, 0):
+            # Prefer bind/port conflicts over generic FATAL lines
+            bind_line = ''
+            last = ''
+            for raw in reversed((diag['recent_logs'] or '').splitlines()):
+                line = self._strip_ansi(raw).strip()
+                if not line:
+                    continue
+                # strip docker --timestamps prefix
+                m_ts = re.match(r'^\d{4}-\d{2}-\d{2}T\S+\s+(.*)$', line)
+                if m_ts:
+                    line = m_ts.group(1).strip()
+                low = line.lower()
+                if 'address already in use' in low and not bind_line:
+                    bind_line = line
+                if ('FATAL' in line or 'failed to load' in low) and not last:
+                    last = line
+                if not last:
+                    last = line
+            pick = bind_line or last
+            if pick and 'address already in use' in pick.lower():
+                m = re.search(r'listen udp :(\d+)', pick, re.I) or re.search(r':(\d+):\s*bind', pick)
+                p = m.group(1) if m else '?'
+                if p == '?':
+                    m2 = re.search(r'udp\s*:(\d+)', pick, re.I)
+                    p = m2.group(1) if m2 else '?'
+                diag['error_summary'] = (
+                    f'UDP port {p} already in use — change port below (try 8998 or 8443)'
+                )
+                diag['port_busy'] = True
+            elif pick:
+                short = re.sub(r'\s+', ' ', pick)[:160]
+                diag['error_summary'] = f"exit {diag['exit_code']}: {short}"
+            else:
+                diag['error_summary'] = f"exited with code {diag['exit_code']}"
+        elif diag['status'] and diag['status'] != 'running':
+            diag['error_summary'] = f"status: {diag['status']}"
+        return diag
+
+    def get_server_status(self, protocol_type=None):
+        protocol_type = protocol_type or self.protocol
+        exists = self.check_protocol_installed(protocol_type)
+        running = self.check_container_running(protocol_type)
+        meta = self._read_metadata() if exists else {}
+        clients = self._read_clients() if exists else []
+        diag = {}
+
+        # Auto-migrate older installs (bridge NAT / userpass / missing BBR+obfs)
+        if exists:
+            try:
+                name = self._container_name(protocol_type)
+                mode, _, _ = self.ssh.run_sudo_command(
+                    f"docker inspect -f '{{{{.HostConfig.NetworkMode}}}}' {name} 2>/dev/null"
+                )
+                mode = (mode or '').strip()
+                cfg = self._read_file(self.config_path)
+                needs_cfg = (
+                    'type: userpass' in cfg
+                    or 'type: salamander' not in cfg
+                    or 'type: password' not in cfg
+                )
+                if (mode and mode != 'host') or needs_cfg:
+                    port = int(meta.get('port') or self.DEFAULT_PORT)
+                    self._write_config_from_clients(port)
+                    self._start_container(port)
+                    running = self.check_container_running(protocol_type)
+                    meta = self._read_metadata()
+            except Exception as e:
+                logger.warning('Hysteria migrate failed: %s', e)
+                diag = {'error_summary': f'migrate failed: {e}'}
+
+        if exists:
+            try:
+                diag = self.get_container_diagnostics(protocol_type)
+                running = bool(diag.get('running'))
+            except Exception as e:
+                logger.warning('Hysteria diagnostics failed: %s', e)
+                diag = {'error_summary': str(e)}
+
+        return {
+            'container_exists': exists,
+            'container_running': running,
+            'port': int(meta.get('port') or self.DEFAULT_PORT),
+            'domain': meta.get('domain'),
+            'email': meta.get('email'),
+            'clients_count': len(clients),
+            'protocol': protocol_type,
+            'base_protocol': self.PROTOCOL,
+            'instance': self._instance_index(protocol_type),
+            'container_name': self._container_name(protocol_type),
+            'error': diag.get('error_summary') or '',
+            'exit_code': diag.get('exit_code'),
+            'container_status': diag.get('status') or '',
+            'recent_logs': diag.get('recent_logs') or '',
+            'port_busy': bool(diag.get('port_busy')),
+        }
+
+    # ===================== HELPERS =====================
+
+    def _validate_domain(self, domain):
+        domain = (domain or '').strip().lower()
+        if not domain or len(domain) > 253:
+            raise ValueError('Domain is required for Hysteria SSL')
+        if not re.match(r'^(?!-)[a-z0-9.-]+(?<!-)$', domain) or '.' not in domain:
+            raise ValueError('Invalid domain name')
+        return domain
+
+    def _validate_email(self, email):
+        email = (email or '').strip()
+        if not email or '@' not in email:
+            raise ValueError("Valid Let's Encrypt email is required")
+        return email
+
+    def _read_file(self, path):
+        out, _, code = self.ssh.run_sudo_command(f"cat {_q(path)} 2>/dev/null")
+        return out if code == 0 else ''
+
+    def _write_file(self, path, content):
+        parent = path.rsplit('/', 1)[0]
+        self.ssh.run_sudo_command(f"mkdir -p {_q(parent)}")
+        self.ssh.upload_file_sudo(content, path)
+
+    def _read_metadata(self):
+        raw = self._read_file(self.meta_path)
+        if not raw.strip():
+            return {}
+        try:
+            return json.loads(raw)
+        except Exception:
+            return {}
+
+    def _write_metadata(self, meta):
+        self._write_file(self.meta_path, json.dumps(meta, indent=2, ensure_ascii=False))
+
+    def _read_clients(self):
+        raw = self._read_file(self.clients_path)
+        if not raw.strip():
+            return []
+        try:
+            data = json.loads(raw)
+            return data if isinstance(data, list) else []
+        except Exception:
+            return []
+
+    def _write_clients(self, clients):
+        self._write_file(self.clients_path, json.dumps(clients, indent=2, ensure_ascii=False))
+
+    def _ensure_secrets(self, meta):
+        """Password auth (Happ/INCY-friendly) + salamander obfs secrets."""
+        changed = False
+        if not meta.get('password'):
+            meta['password'] = _rand_token(24)
+            changed = True
+        if not meta.get('obfs_password'):
+            meta['obfs_password'] = _rand_token(16)
+            changed = True
+        if changed:
+            self._write_metadata(meta)
+        return meta
+
+    def _build_server_yaml(self, port, clients, meta=None):
+        meta = self._ensure_secrets(meta if meta is not None else self._read_metadata())
+        password = meta['password']
+        obfs_password = meta['obfs_password']
+        # password auth — Happ / sing-box / INCY expect a single auth string, not userpass
+        lines = [
+            f'listen: :{int(port)}',
+            '',
+            'tls:',
+            '  cert: /etc/hysteria/cert.crt',
+            '  key: /etc/hysteria/private.key',
+            '',
+            'auth:',
+            '  type: password',
+            f'  password: "{password}"',
+            '',
+            'obfs:',
+            '  type: salamander',
+            '  salamander:',
+            f'    password: "{obfs_password}"',
+            '',
+            'quic:',
+            '  initStreamReceiveWindow: 8388608',
+            '  maxStreamReceiveWindow: 8388608',
+            '  initConnReceiveWindow: 20971520',
+            '  maxConnReceiveWindow: 20971520',
+            '  maxIdleTimeout: 60s',
+            '  maxIncomingStreams: 1024',
+            '  disablePathMTUDiscovery: true',
+            '',
+            'ignoreClientBandwidth: true',
+            '',
+            'bandwidth:',
+            '  up: 1 gbps',
+            '  down: 1 gbps',
+            '',
+            'masquerade:',
+            '  type: proxy',
+            '  proxy:',
+            '    url: https://www.bing.com',
+            '    rewriteHost: true',
+            '',
+            'outbounds:',
+            '  - name: direct',
+            '    type: direct',
+            '',
+        ]
+        return '\n'.join(lines)
+
+    def _write_config_from_clients(self, port=None):
+        meta = self._ensure_secrets(self._read_metadata())
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        # clients list is panel-side only (shared password); still rewrite yaml for port/obfs/secrets
+        self._write_file(self.config_path, self._build_server_yaml(port, self._read_clients(), meta))
+        return port
+
+    def _tune_host_network(self):
+        """UDP buffers + BBR — reduces quic-go EOF and improves throughput."""
+        script = r"""
+set +e
+mkdir -p /etc/sysctl.d
+printf '%s\n' \
+  'net.core.rmem_max=16777216' \
+  'net.core.wmem_max=16777216' \
+  'net.core.rmem_default=16777216' \
+  'net.core.wmem_default=16777216' \
+  'net.core.default_qdisc=fq' \
+  'net.ipv4.tcp_congestion_control=bbr' \
+  'net.ipv4.ip_forward=1' \
+  > /etc/sysctl.d/99-amnezia-hysteria.conf
+modprobe tcp_bbr >/dev/null 2>&1 || true
+sysctl -p /etc/sysctl.d/99-amnezia-hysteria.conf >/dev/null 2>&1 || true
+sysctl -w net.core.rmem_max=16777216 >/dev/null 2>&1 || true
+sysctl -w net.core.wmem_max=16777216 >/dev/null 2>&1 || true
+sysctl -w net.core.rmem_default=16777216 >/dev/null 2>&1 || true
+sysctl -w net.core.wmem_default=16777216 >/dev/null 2>&1 || true
+sysctl -w net.core.default_qdisc=fq >/dev/null 2>&1 || true
+sysctl -w net.ipv4.tcp_congestion_control=bbr >/dev/null 2>&1 || true
+sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
+"""
+        self.ssh.run_sudo_command(f"sh -c {_q(script)}", timeout=30)
+
+    def _strip_ansi(self, text):
+        return re.sub(r'\x1b\[[0-9;]*m', '', text or '')
+
+    def _udp_port_busy(self, port):
+        """Return (busy: bool, detail: str) for host UDP port (after our container is removed)."""
+        port = int(port)
+        out, _, _ = self.ssh.run_sudo_command(
+            f"ss -ulnp 'sport = :{port}' 2>/dev/null || "
+            f"ss -uln | grep -E ':{port}([[:space:]]|$)' || true"
+        )
+        detail = (out or '').strip()
+        return bool(detail), detail[:240]
+
+    def _open_udp_port(self, port):
+        port = int(port)
+        script = f"""
+set +e
+if command -v ufw >/dev/null 2>&1; then
+  ufw allow {port}/udp >/dev/null 2>&1 || true
+fi
+if command -v firewall-cmd >/dev/null 2>&1; then
+  firewall-cmd --permanent --add-port={port}/udp >/dev/null 2>&1 || true
+  firewall-cmd --reload >/dev/null 2>&1 || true
+fi
+iptables -C INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || iptables -I INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || true
+"""
+        self.ssh.run_sudo_command(f"sh -c {_q(script)}", timeout=30)
+
+    def _start_container(self, port):
+        """Run with --network host so QUIC/UDP is not broken by Docker NAT (EOF)."""
+        name = self.container_name
+        port = int(port)
+        if port == 80:
+            raise RuntimeError('Port 80 is reserved for Let\'s Encrypt validation')
+        self._tune_host_network()
+        self._open_udp_port(port)
+        self.ssh.run_sudo_command(
+            f"chmod 644 {_q(self.cert_path)} {_q(self.key_path)} 2>/dev/null || true"
+        )
+        self.ssh.run_sudo_command(f"docker rm -fv {name} 2>/dev/null || true")
+        busy, detail = self._udp_port_busy(port)
+        if busy:
+            raise RuntimeError(
+                f'UDP port {port} is already in use — choose another port in Hysteria settings. '
+                f'({self._strip_ansi(detail)})'
+            )
+        run_cmd = (
+            f"docker run -d --restart always "
+            f"--name {name} "
+            f"--network host "
+            f"--cap-add=NET_ADMIN "
+            f"-v {_q(self.base_dir)}:/etc/hysteria "
+            f"{self.IMAGE_NAME} "
+            f"-c /etc/hysteria/server.yaml server"
+        )
+        _, err, code = self.ssh.run_sudo_command(run_cmd, timeout=60)
+        if code != 0:
+            raise RuntimeError(f'Failed to start Hysteria: {err}')
+        # Confirm it stayed up (catch immediate bind failures)
+        time.sleep(1.2)
+        if not self.check_container_running(self.protocol):
+            diag = self.get_container_diagnostics(self.protocol)
+            raise RuntimeError(
+                diag.get('error_summary')
+                or 'Hysteria container exited immediately — check logs / port'
+            )
+        return True
+
+    def get_settings(self):
+        meta = self._ensure_secrets(self._read_metadata())
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        return {
+            'port': port,
+            'suggested_port': 8998 if port in (443, 80) else port,
+            'domain': meta.get('domain') or '',
+            'email': meta.get('email') or '',
+            'protocol': self.protocol,
+        }
+
+    def update_settings(self, port=None, domain=None, email=None, renew_ssl=False):
+        """Change listen UDP port and/or re-issue Let's Encrypt for domain."""
+        meta = self._ensure_secrets(self._read_metadata())
+        if port is None:
+            port = meta.get('port') or self.DEFAULT_PORT
+        port = int(port)
+        if port < 1 or port > 65535:
+            return {'status': 'error', 'message': 'Invalid port'}
+        if port == 80:
+            return {'status': 'error', 'message': 'Port 80 is reserved for Let\'s Encrypt validation'}
+
+        old_domain = (meta.get('domain') or '').strip().lower()
+        domain_changed = False
+        try:
+            if domain is not None and str(domain).strip():
+                new_domain = self._validate_domain(domain)
+                domain_changed = new_domain != old_domain
+                meta['domain'] = new_domain
+            if email is not None and str(email).strip():
+                meta['email'] = self._validate_email(email)
+        except ValueError as e:
+            return {'status': 'error', 'message': str(e)}
+
+        if renew_ssl or domain_changed:
+            # Domain change or explicit renew → re-issue certificate (needs free TCP 80)
+            try:
+                d = meta.get('domain') or ''
+                e = meta.get('email') or ''
+                if not d or not e:
+                    return {
+                        'status': 'error',
+                        'message': 'Domain and email are required to issue SSL',
+                    }
+                self._issue_certificate(d, e)
+            except Exception as exc:
+                return {'status': 'error', 'message': str(exc)}
+
+        meta['port'] = port
+        self._write_metadata(meta)
+        self._write_config_from_clients(port)
+        try:
+            self._start_container(port)
+        except Exception as e:
+            return {
+                'status': 'error',
+                'message': str(e),
+                'port': str(port),
+                'domain': meta.get('domain'),
+                'email': meta.get('email'),
+            }
+        msg = 'Hysteria settings updated'
+        if renew_ssl or domain_changed:
+            msg = 'SSL certificate issued and Hysteria settings updated'
+        return {
+            'status': 'success',
+            'port': str(port),
+            'domain': meta.get('domain'),
+            'email': meta.get('email'),
+            'message': msg,
+        }
+
+    def _reload_container(self):
+        meta = self._read_metadata()
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        try:
+            self._start_container(port)
+        except Exception as e:
+            logger.warning('Hysteria container reload failed: %s', e)
+
+    def _issue_certificate(self, domain, email):
+        """Issue Let's Encrypt cert via certbot standalone (needs free TCP 80)."""
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.letsencrypt_dir)}")
+        self.ssh.run_sudo_command(f"docker pull {self.CERTBOT_IMAGE}", timeout=180)
+
+        # Stop anything briefly occupying 80 if it's our leftover certbot
+        self.ssh.run_sudo_command(
+            "docker rm -fv amnezia-hysteria-certbot 2>/dev/null || true"
+        )
+
+        cmd = (
+            f"docker run --rm --name amnezia-hysteria-certbot "
+            f"-p 80:80 "
+            f"-v {_q(self.letsencrypt_dir)}:/etc/letsencrypt "
+            f"{self.CERTBOT_IMAGE} certonly --standalone "
+            f"--non-interactive --agree-tos --no-eff-email "
+            f"--email {_q(email)} -d {_q(domain)}"
+        )
+        out, err, code = self.ssh.run_sudo_command(cmd, timeout=300)
+        if code != 0:
+            raise RuntimeError(
+                f"Let's Encrypt failed for {domain}. "
+                f"Point A-record to this server and free TCP port 80. {err or out}"
+            )
+
+        # Copy live certs into paths expected by the server config
+        copy_script = f"""
+set -e
+LIVE={_q(self.letsencrypt_dir)}/live/{_q(domain)}
+test -s "$LIVE/fullchain.pem"
+test -s "$LIVE/privkey.pem"
+cp -f "$LIVE/fullchain.pem" {_q(self.cert_path)}
+cp -f "$LIVE/privkey.pem" {_q(self.key_path)}
+chmod 644 {_q(self.cert_path)} {_q(self.key_path)}
+"""
+        out, err, code = self.ssh.run_sudo_command(f"sh -c {_q(copy_script)}", timeout=30)
+        if code != 0:
+            raise RuntimeError(f'Failed to install certificate files: {err or out}')
+
+    def _build_share_uri(self, host, port, domain, name, meta=None):
+        """Happ/INCY-compatible hy2 link: password auth + salamander + IP host + SNI."""
+        meta = self._ensure_secrets(meta if meta is not None else self._read_metadata())
+        password = meta['password']
+        obfs_password = meta['obfs_password']
+        sni = domain or host
+        # Prefer raw IP in URI — domain may be CDN/DNS filtered for UDP while ICMP still works
+        conn_host = host or domain
+        fragment = quote(name or 'hysteria', safe='')
+        return (
+            f"hy2://{quote(password, safe='')}@{conn_host}:{int(port)}/"
+            f"?sni={quote(sni, safe='')}"
+            f"&obfs=salamander"
+            f"&obfs-password={quote(obfs_password, safe='')}"
+            f"&insecure=0#{fragment}"
+        )
+
+    # ===================== INSTALL / REMOVE =====================
+
+    def install_protocol(self, protocol_type=None, port=None, domain=None, email=None):
+        protocol_type = protocol_type or self.protocol
+        if not self.check_docker_installed():
+            return {'status': 'error', 'message': 'Docker not installed'}
+
+        domain = self._validate_domain(domain)
+        email = self._validate_email(email)
+        port = int(port or self.DEFAULT_PORT)
+        if port == 80:
+            return {'status': 'error', 'message': 'Port 80 is reserved for Let\'s Encrypt validation'}
+
+        log = []
+        self.ssh.run_sudo_command(f"docker pull {self.IMAGE_NAME}", timeout=180)
+        log.append(f'Pulled {self.IMAGE_NAME}')
+
+        if self.check_protocol_installed(protocol_type):
+            name = self._container_name(protocol_type)
+            self.ssh.run_sudo_command(f"docker rm -fv {name} 2>/dev/null || true")
+            log.append('Removed previous container')
+
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.base_dir)}")
+        self._write_clients([])
+        meta = {
+            'domain': domain,
+            'email': email,
+            'port': port,
+            'password': _rand_token(24),
+            'obfs_password': _rand_token(16),
+        }
+        self._write_metadata(meta)
+        self._write_config_from_clients(port)
+        log.append('Prepared config directory (password auth + salamander + BBR)')
+
+        try:
+            self._issue_certificate(domain, email)
+            log.append(f"Issued Let's Encrypt certificate for {domain}")
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+
+        try:
+            self._start_container(port)
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+
+        log.append(f'Started {self.container_name} on UDP {port} (host network, BBR)')
+        return {
+            'status': 'success',
+            'message': 'Hysteria installed',
+            'log': log,
+            'port': str(port),
+            'domain': domain,
+            'email': email,
+        }
+
+    def remove_container(self, protocol_type=None):
+        protocol_type = protocol_type or self.protocol
+        name = self._container_name(protocol_type)
+        base = self._base_dir(protocol_type)
+        self.ssh.run_sudo_command(f"docker rm -fv {name} 2>/dev/null || true")
+        self.ssh.run_sudo_command(f"rm -rf {_q(base)}")
+        return True
+
+    def get_server_config(self, protocol_type=None):
+        return self._read_file(self.config_path)
+
+    def save_server_config(self, protocol_type=None, config_text=''):
+        self._write_file(self.config_path, config_text or '')
+        self._reload_container()
+        return True
+
+    # ===================== CLIENTS =====================
+
+    def get_clients(self, protocol_type=None):
+        clients = self._read_clients()
+        result = []
+        for c in clients:
+            cname = c.get('name') or c.get('id')
+            result.append({
+                'clientId': c.get('id'),
+                'client_id': c.get('id'),
+                'id': c.get('id'),
+                'name': cname,
+                'email': cname,
+                'enabled': c.get('enabled', True),
+                'userData': {'clientName': cname, 'enabled': c.get('enabled', True)},
+            })
+        return result
+
+    def add_client(self, protocol_type, name, host, port=None):
+        meta = self._ensure_secrets(self._read_metadata())
+        domain = meta.get('domain') or host
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        client_id = secrets.token_hex(8)
+        clients = self._read_clients()
+        clients.append({
+            'id': client_id,
+            'name': name or f'client-{client_id[:6]}',
+            'enabled': True,
+        })
+        self._write_clients(clients)
+        # Shared password auth — refresh yaml only if secrets/port changed
+        self._write_config_from_clients(port)
+        self._reload_container()
+        config = self._build_share_uri(host, port, domain, name or client_id, meta)
+        return {'client_id': client_id, 'config': config}
+
+    def get_client_config(self, protocol_type, client_id, host, port=None):
+        meta = self._ensure_secrets(self._read_metadata())
+        domain = meta.get('domain') or host
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        clients = self._read_clients()
+        client = next((c for c in clients if c.get('id') == client_id), None)
+        if not client:
+            raise RuntimeError('Client not found')
+        if client.get('enabled', True) is False:
+            raise RuntimeError('Client is disabled')
+        return self._build_share_uri(
+            host, port, domain,
+            client.get('name') or client_id,
+            meta,
+        )
+
+    def remove_client(self, protocol_type, client_id):
+        clients = [c for c in self._read_clients() if c.get('id') != client_id]
+        self._write_clients(clients)
+        return True
+
+    def toggle_client(self, protocol_type, client_id, enable=True):
+        clients = self._read_clients()
+        found = False
+        for c in clients:
+            if c.get('id') == client_id:
+                c['enabled'] = bool(enable)
+                found = True
+                break
+        if not found:
+            raise RuntimeError('Client not found')
+        self._write_clients(clients)
+        return True

managers/naiveproxy_manager.py

@@ -0,0 +1,604 @@
+"""
+NaiveProxy manager — Caddy + klzgrad/forwardproxy (naive fork).
+
+Server side is the naïve Caddy forward_proxy from:
+  https://github.com/klzgrad/naiveproxy
+  https://github.com/klzgrad/forwardproxy
+
+Uses the official prebuilt Caddy binary on amd64, or builds via xcaddy on other
+arches. Clients authenticate with HTTP basic auth; share links are
+naive+https://user:pass@domain URIs (NekoRay / sing-box compatible).
+Requires free TCP 80 (ACME) and 443 (HTTPS / HTTP2 proxy).
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+import secrets
+import shlex
+import string
+import time
+from urllib.parse import quote
+
+logger = logging.getLogger(__name__)
+
+
+def _q(value):
+    return shlex.quote(str(value))
+
+
+def _rand_token(length=16):
+    alphabet = string.ascii_lowercase + string.digits
+    return ''.join(secrets.choice(alphabet) for _ in range(length))
+
+
+class NaiveProxyManager:
+    PROTOCOL = 'naiveproxy'
+    CONTAINER_NAME = 'amnezia-naiveproxy'
+    IMAGE_NAME = 'amnezia-naiveproxy:local'
+    BASE_DIR = '/opt/amnezia/naiveproxy'
+    DEFAULT_PORT = 443
+    # Official Caddy+forwardproxy naive build (linux amd64)
+    CADDY_RELEASE = 'v2.11.2-naive'
+    CADDY_URL = (
+        'https://github.com/klzgrad/forwardproxy/releases/download/'
+        f'{CADDY_RELEASE}/caddy-forwardproxy-naive.tar.xz'
+    )
+
+    def __init__(self, ssh, protocol='naiveproxy'):
+        self.ssh = ssh
+        self.protocol = protocol or self.PROTOCOL
+        self.container_name = self.CONTAINER_NAME
+        self.base_dir = self.BASE_DIR
+        self.caddyfile_path = f'{self.base_dir}/Caddyfile'
+        self.clients_path = f'{self.base_dir}/clients.json'
+        self.meta_path = f'{self.base_dir}/metadata.json'
+        self.html_dir = f'{self.base_dir}/html'
+        self.bin_dir = f'{self.base_dir}/bin'
+        self.data_dir = f'{self.base_dir}/caddy-data'
+        self.config_dir = f'{self.base_dir}/caddy-config'
+
+    # ===================== STATUS =====================
+
+    def check_docker_installed(self):
+        out, _, code = self.ssh.run_command("docker --version 2>/dev/null")
+        if code != 0:
+            return False
+        out2, _, _ = self.ssh.run_command(
+            "systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
+        )
+        return 'active' in out2 or 'running' in out2.lower()
+
+    def check_protocol_installed(self, protocol_type=None):
+        out, _, _ = self.ssh.run_sudo_command(
+            f"docker ps -a --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Names}}}}'"
+        )
+        return self.CONTAINER_NAME in out.strip().split('\n')
+
+    def check_container_running(self, protocol_type=None):
+        out, _, _ = self.ssh.run_sudo_command(
+            f"docker ps --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Status}}}}'"
+        )
+        return 'Up' in out
+
+    def get_logs(self, protocol_type=None, tail=200):
+        tail = max(20, min(int(tail or 200), 2000))
+        out, err, code = self.ssh.run_sudo_command(
+            f"docker logs --tail {tail} --timestamps {self.CONTAINER_NAME} 2>&1",
+            timeout=30,
+        )
+        text = (out or err or '').strip()
+        if code != 0 and not text:
+            text = f'(no logs: exit {code})'
+        return text
+
+    def get_container_diagnostics(self, protocol_type=None):
+        fmt = (
+            '{{.State.Status}}|{{.State.Running}}|{{.State.ExitCode}}|'
+            '{{.State.OOMKilled}}|{{.State.Error}}|{{.State.FinishedAt}}|'
+            '{{.State.StartedAt}}'
+        )
+        out, _, code = self.ssh.run_sudo_command(
+            f"docker inspect -f '{fmt}' {self.CONTAINER_NAME} 2>/dev/null"
+        )
+        diag = {
+            'status': 'unknown',
+            'running': False,
+            'exit_code': None,
+            'error_summary': '',
+            'recent_logs': '',
+        }
+        if code == 0 and out.strip():
+            parts = out.strip().split('|')
+            while len(parts) < 7:
+                parts.append('')
+            diag['status'] = parts[0]
+            diag['running'] = parts[1].lower() == 'true'
+            try:
+                diag['exit_code'] = int(parts[2])
+            except ValueError:
+                diag['exit_code'] = parts[2]
+            if parts[3].lower() == 'true':
+                diag['error_summary'] = 'OOM killed'
+            elif parts[4]:
+                diag['error_summary'] = parts[4]
+            elif not diag['running'] and diag['exit_code'] not in (0, '0', None, ''):
+                diag['error_summary'] = f'Exited with code {diag["exit_code"]}'
+        diag['recent_logs'] = self.get_logs(protocol_type, tail=80)
+        if not diag['error_summary'] and not diag['running']:
+            logs = diag['recent_logs'].lower()
+            if 'address already in use' in logs or 'bind:' in logs:
+                diag['error_summary'] = (
+                    'TCP 80/443 already in use — free them or stop conflicting services'
+                )
+        return diag
+
+    def get_server_status(self, protocol_type=None):
+        protocol_type = protocol_type or self.protocol
+        exists = self.check_protocol_installed(protocol_type)
+        running = self.check_container_running(protocol_type) if exists else False
+        meta = self._read_metadata() if exists else {}
+        clients = self._read_clients() if exists else []
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        return {
+            'container_exists': exists,
+            'container_running': running,
+            'port': port,
+            'domain': meta.get('domain') or '',
+            'email': meta.get('email') or '',
+            'clients_count': len(clients),
+            'protocol': protocol_type,
+            'base_protocol': self.PROTOCOL,
+            'instance': 1,
+            'container_name': self.CONTAINER_NAME,
+        }
+
+    # ===================== IO HELPERS =====================
+
+    def _validate_domain(self, domain):
+        domain = (domain or '').strip().lower()
+        if not domain or len(domain) > 253:
+            raise ValueError('Domain is required')
+        if not re.match(r'^(?!-)[a-z0-9.-]+(?<!-)$', domain) or '.' not in domain:
+            raise ValueError('Invalid domain name')
+        return domain
+
+    def _validate_email(self, email):
+        email = (email or '').strip()
+        if not email or '@' not in email:
+            raise ValueError('Valid Let\'s Encrypt email is required')
+        return email
+
+    def _read_file(self, path):
+        out, _, code = self.ssh.run_sudo_command(f"cat {_q(path)} 2>/dev/null")
+        return out if code == 0 else ''
+
+    def _write_file(self, path, content):
+        # Write via base64 to avoid shell escaping issues
+        import base64
+        b64 = base64.b64encode((content or '').encode('utf-8')).decode('ascii')
+        script = (
+            f"mkdir -p $(dirname {_q(path)}) && "
+            f"echo {_q(b64)} | base64 -d > {_q(path)}"
+        )
+        out, err, code = self.ssh.run_sudo_command(f"sh -c {_q(script)}", timeout=30)
+        if code != 0:
+            raise RuntimeError(f'Failed to write {path}: {err or out}')
+
+    def _read_metadata(self):
+        raw = self._read_file(self.meta_path).strip()
+        if not raw:
+            return {}
+        try:
+            data = json.loads(raw)
+            return data if isinstance(data, dict) else {}
+        except Exception:
+            return {}
+
+    def _write_metadata(self, meta):
+        self._write_file(self.meta_path, json.dumps(meta, indent=2, ensure_ascii=False))
+
+    def _read_clients(self):
+        raw = self._read_file(self.clients_path).strip()
+        if not raw:
+            return []
+        try:
+            data = json.loads(raw)
+            return data if isinstance(data, list) else []
+        except Exception:
+            return []
+
+    def _write_clients(self, clients):
+        self._write_file(self.clients_path, json.dumps(clients, indent=2, ensure_ascii=False))
+
+    def _caddy_auth_lines(self, clients):
+        lines = []
+        for c in clients:
+            if c.get('enabled', True) is False:
+                continue
+            user = (c.get('username') or '').strip()
+            password = (c.get('password') or '').strip()
+            if not user or not password:
+                continue
+            # Credentials are alphanumeric from our generator — safe in Caddyfile
+            lines.append(f'    basic_auth {user} {password}')
+        return lines
+
+    def _build_caddyfile(self, domain, email, clients, probe_path):
+        auth_lines = self._caddy_auth_lines(clients)
+        if not auth_lines:
+            # Keep a non-shared bootstrap user so the proxy is never open
+            auth_lines = [f'    basic_auth bootstrap {_rand_token(24)}']
+        auth_block = '\n'.join(auth_lines)
+        # probe_resistance looks like a fake domain to browsers
+        probe = (probe_path or _rand_token(12)).strip('/')
+        if '.' not in probe:
+            probe = f'{probe}.com'
+        return f"""{{
+  order forward_proxy before file_server
+  admin off
+  log {{
+    exclude http.log.error
+  }}
+}}
+:443, {domain} {{
+  tls {email}
+  encode
+  forward_proxy {{
+{auth_block}
+    hide_ip
+    hide_via
+    probe_resistance {probe}
+  }}
+  file_server {{
+    root /var/www/html
+  }}
+}}
+"""
+
+    def _write_config_from_clients(self):
+        meta = self._read_metadata()
+        domain = meta.get('domain') or ''
+        email = meta.get('email') or ''
+        if not domain or not email:
+            raise RuntimeError('Domain and email are required in metadata')
+        clients = self._read_clients()
+        probe = meta.get('probe_resistance') or _rand_token(12)
+        if not meta.get('probe_resistance'):
+            meta['probe_resistance'] = probe
+            self._write_metadata(meta)
+        text = self._build_caddyfile(domain, email, clients, probe)
+        self._write_file(self.caddyfile_path, text)
+
+    def _ensure_placeholder_site(self):
+        index = f'{self.html_dir}/index.html'
+        existing = self._read_file(index)
+        if existing.strip():
+            return
+        html = (
+            '<!DOCTYPE html><html><head><meta charset="utf-8">'
+            '<title>Welcome</title></head><body><h1>It works</h1></body></html>\n'
+        )
+        self._write_file(index, html)
+
+    def _host_arch(self):
+        out, _, _ = self.ssh.run_command("uname -m")
+        return (out or '').strip().lower()
+
+    def _prepare_caddy_binary(self, log):
+        """Download official amd64 build or compile with xcaddy for other arches."""
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.bin_dir)}")
+        arch = self._host_arch()
+        caddy_path = f'{self.bin_dir}/caddy'
+
+        if arch in ('x86_64', 'amd64'):
+            script = f"""
+set -e
+cd {_q(self.bin_dir)}
+curl -fsSL -o caddy-forwardproxy-naive.tar.xz {_q(self.CADDY_URL)}
+tar -xf caddy-forwardproxy-naive.tar.xz
+if [ -f caddy-forwardproxy-naive/caddy ]; then
+  cp -f caddy-forwardproxy-naive/caddy ./caddy
+elif [ -f caddy ]; then
+  true
+else
+  echo "caddy binary not found in archive" >&2
+  exit 1
+fi
+chmod +x ./caddy
+./caddy version
+"""
+            out, err, code = self.ssh.run_sudo_command(f"bash -lc {_q(script)}", timeout=300)
+            if code != 0:
+                raise RuntimeError(f'Failed to download NaiveProxy Caddy: {err or out}')
+            log.append(f'Downloaded official Caddy+forwardproxy ({self.CADDY_RELEASE})')
+            return caddy_path
+
+        # arm64 / other: build with xcaddy inside golang image
+        build_script = f"""
+set -e
+docker pull golang:1.22-bookworm
+docker run --rm -v {_q(self.bin_dir)}:/out -w /tmp golang:1.22-bookworm bash -lc '
+set -e
+go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
+/go/bin/xcaddy build --with github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@naive
+cp -f caddy /out/caddy
+chmod +x /out/caddy
+'
+{_q(caddy_path)} version
+"""
+        out, err, code = self.ssh.run_sudo_command(f"bash -lc {_q(build_script)}", timeout=900)
+        if code != 0:
+            raise RuntimeError(f'Failed to build NaiveProxy Caddy for {arch}: {err or out}')
+        log.append(f'Built Caddy+forwardproxy via xcaddy for {arch}')
+        return caddy_path
+
+    def _build_docker_image(self, log):
+        dockerfile = f"""FROM debian:bookworm-slim
+RUN apt-get update \\
+ && apt-get install -y --no-install-recommends ca-certificates \\
+ && rm -rf /var/lib/apt/lists/*
+COPY caddy /usr/bin/caddy
+RUN chmod +x /usr/bin/caddy
+WORKDIR /etc/caddy
+EXPOSE 80 443
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+"""
+        self._write_file(f'{self.bin_dir}/Dockerfile', dockerfile)
+        out, err, code = self.ssh.run_sudo_command(
+            f"docker build -t {self.IMAGE_NAME} {_q(self.bin_dir)}",
+            timeout=300,
+        )
+        if code != 0:
+            raise RuntimeError(f'Failed to build Docker image: {err or out}')
+        log.append(f'Built image {self.IMAGE_NAME}')
+
+    def _start_container(self):
+        self.ssh.run_sudo_command(
+            f"docker rm -fv {self.CONTAINER_NAME} 2>/dev/null || true"
+        )
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.data_dir)} {_q(self.config_dir)} {_q(self.html_dir)}")
+        run_cmd = (
+            f"docker run -d --name {self.CONTAINER_NAME} --restart unless-stopped "
+            f"--network host "
+            f"-v {_q(self.base_dir)}:/etc/caddy "
+            f"-v {_q(self.html_dir)}:/var/www/html "
+            f"-v {_q(self.data_dir)}:/data "
+            f"-v {_q(self.config_dir)}:/config "
+            f"-e XDG_DATA_HOME=/data "
+            f"-e XDG_CONFIG_HOME=/config "
+            f"{self.IMAGE_NAME}"
+        )
+        _, err, code = self.ssh.run_sudo_command(run_cmd, timeout=60)
+        if code != 0:
+            raise RuntimeError(f'Failed to start NaiveProxy: {err}')
+        time.sleep(2.0)
+        if not self.check_container_running():
+            diag = self.get_container_diagnostics()
+            raise RuntimeError(
+                diag.get('error_summary')
+                or 'NaiveProxy container exited — free TCP 80/443 and check logs'
+            )
+        return True
+
+    def _reload_container(self):
+        try:
+            self._write_config_from_clients()
+            # Prefer graceful reload; fall back to recreate
+            out, _, code = self.ssh.run_sudo_command(
+                f"docker exec {self.CONTAINER_NAME} caddy reload "
+                f"--config /etc/caddy/Caddyfile --adapter caddyfile 2>&1",
+                timeout=30,
+            )
+            if code != 0:
+                logger.warning('Caddy reload failed (%s), recreating container', out)
+                self._start_container()
+        except Exception as e:
+            logger.warning('NaiveProxy reload failed: %s', e)
+            self._start_container()
+
+    def _build_share_uri(self, domain, username, password, name, port=443):
+        """v2rayN / NekoRay / sing-box compatible share link.
+
+        Always include an explicit port — without `:443` v2rayN often treats
+        the port as empty/80 and shows «Свойство Порт недопустимо» / SSL errors.
+        """
+        # Keep credentials unescaped when alphanumeric (our generator); quote otherwise.
+        user = quote(username or '', safe='')
+        pw = quote(password or '', safe='')
+        host = (domain or '').strip().lower()
+        port = int(port or 443)
+        if port < 1 or port > 65535:
+            port = 443
+        # Remark: ASCII-safe, no spaces that break some importers
+        remark = re.sub(r'[^\w.\-]+', '-', (name or 'naiveproxy').strip())[:48] or 'naiveproxy'
+        return f'naive+https://{user}:{pw}@{host}:{port}#{remark}'
+
+    # ===================== INSTALL / REMOVE =====================
+
+    def install_protocol(self, protocol_type=None, port=None, domain=None, email=None):
+        protocol_type = protocol_type or self.protocol
+        if not self.check_docker_installed():
+            return {'status': 'error', 'message': 'Docker not installed'}
+
+        try:
+            domain = self._validate_domain(domain)
+            email = self._validate_email(email)
+        except ValueError as e:
+            return {'status': 'error', 'message': str(e)}
+
+        port = int(port or self.DEFAULT_PORT)
+        if port not in (443,):
+            # Caddy ACME + naive typically bind :443; keep simple for beta
+            port = 443
+
+        log = []
+        self.ssh.run_sudo_command(f"mkdir -p {_q(self.base_dir)} {_q(self.html_dir)} {_q(self.bin_dir)}")
+
+        if self.check_protocol_installed(protocol_type):
+            self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} 2>/dev/null || true")
+            log.append('Removed previous container')
+
+        try:
+            self._prepare_caddy_binary(log)
+            self._build_docker_image(log)
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+
+        self._write_clients([])
+        meta = {
+            'domain': domain,
+            'email': email,
+            'port': port,
+            'probe_resistance': _rand_token(12),
+            'caddy_release': self.CADDY_RELEASE,
+        }
+        self._write_metadata(meta)
+        self._ensure_placeholder_site()
+        try:
+            self._write_config_from_clients()
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+        log.append('Wrote Caddyfile (forward_proxy + ACME TLS)')
+
+        try:
+            self._start_container()
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+
+        log.append(
+            f'Started {self.CONTAINER_NAME} on TCP 443 (host network). '
+            'Ports 80 and 443 must stay free for ACME and HTTPS.'
+        )
+        return {
+            'status': 'success',
+            'message': 'NaiveProxy installed',
+            'log': log,
+            'port': str(port),
+            'domain': domain,
+            'email': email,
+        }
+
+    def remove_container(self, protocol_type=None):
+        self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} 2>/dev/null || true")
+        self.ssh.run_sudo_command(f"rm -rf {_q(self.base_dir)}")
+        return True
+
+    def get_server_config(self, protocol_type=None):
+        return self._read_file(self.caddyfile_path)
+
+    def save_server_config(self, protocol_type=None, config_text=''):
+        self._write_file(self.caddyfile_path, config_text or '')
+        self._reload_container()
+        return True
+
+    def get_settings(self):
+        meta = self._read_metadata()
+        return {
+            'port': int(meta.get('port') or self.DEFAULT_PORT),
+            'domain': meta.get('domain') or '',
+            'email': meta.get('email') or '',
+            'protocol': self.protocol,
+        }
+
+    def update_settings(self, domain=None, email=None):
+        meta = self._read_metadata()
+        try:
+            if domain is not None and str(domain).strip():
+                meta['domain'] = self._validate_domain(domain)
+            if email is not None and str(email).strip():
+                meta['email'] = self._validate_email(email)
+        except ValueError as e:
+            return {'status': 'error', 'message': str(e)}
+        if not meta.get('domain') or not meta.get('email'):
+            return {'status': 'error', 'message': 'Domain and email are required'}
+        meta['port'] = int(meta.get('port') or self.DEFAULT_PORT)
+        self._write_metadata(meta)
+        try:
+            self._write_config_from_clients()
+            self._start_container()
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), **self.get_settings()}
+        return {'status': 'success', 'message': 'NaiveProxy settings updated', **self.get_settings()}
+
+    # ===================== CLIENTS =====================
+
+    def get_clients(self, protocol_type=None):
+        clients = self._read_clients()
+        result = []
+        for c in clients:
+            cname = c.get('name') or c.get('username') or c.get('id')
+            result.append({
+                'clientId': c.get('id'),
+                'client_id': c.get('id'),
+                'id': c.get('id'),
+                'name': cname,
+                'email': cname,
+                'enabled': c.get('enabled', True),
+                'userData': {
+                    'clientName': cname,
+                    'enabled': c.get('enabled', True),
+                    'username': c.get('username'),
+                },
+            })
+        return result
+
+    def add_client(self, protocol_type, name, host, port=None):
+        meta = self._read_metadata()
+        domain = meta.get('domain') or host
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        client_id = secrets.token_hex(8)
+        username = f'u{client_id[:8]}'
+        password = _rand_token(20)
+        clients = self._read_clients()
+        clients.append({
+            'id': client_id,
+            'name': name or f'client-{client_id[:6]}',
+            'username': username,
+            'password': password,
+            'enabled': True,
+        })
+        self._write_clients(clients)
+        self._reload_container()
+        config = self._build_share_uri(domain, username, password, name or client_id, port)
+        return {'client_id': client_id, 'config': config}
+
+    def get_client_config(self, protocol_type, client_id, host, port=None):
+        meta = self._read_metadata()
+        domain = meta.get('domain') or host
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        clients = self._read_clients()
+        client = next((c for c in clients if c.get('id') == client_id), None)
+        if not client:
+            raise RuntimeError('Client not found')
+        if client.get('enabled', True) is False:
+            raise RuntimeError('Client is disabled')
+        return self._build_share_uri(
+            domain,
+            client.get('username'),
+            client.get('password'),
+            client.get('name') or client_id,
+            port,
+        )
+
+    def remove_client(self, protocol_type, client_id):
+        clients = [c for c in self._read_clients() if c.get('id') != client_id]
+        self._write_clients(clients)
+        self._reload_container()
+        return True
+
+    def toggle_client(self, protocol_type, client_id, enable=True):
+        clients = self._read_clients()
+        found = False
+        for c in clients:
+            if c.get('id') == client_id:
+                c['enabled'] = bool(enable)
+                found = True
+                break
+        if not found:
+            raise RuntimeError('Client not found')
+        self._write_clients(clients)
+        self._reload_container()
+        return True

managers/update_manager.py

@@ -0,0 +1,249 @@
+"""Panel self-update from the EvilFox Gitea repository."""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import subprocess
+import sys
+import threading
+import time
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_REPO_URL = 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main'
+DEFAULT_GIT_URL = 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main.git'
+DEFAULT_API_LATEST = 'https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest'
+UPDATE_REMOTE = 'panel-update'
+
+
+def _env(name: str, default: str) -> str:
+    return (os.environ.get(name) or default).strip()
+
+
+def repo_url() -> str:
+    return _env('PANEL_UPDATE_REPO_URL', DEFAULT_REPO_URL).rstrip('/')
+
+
+def git_url() -> str:
+    return _env('PANEL_UPDATE_GIT_URL', DEFAULT_GIT_URL)
+
+
+def api_latest_url() -> str:
+    return _env('PANEL_UPDATE_API_LATEST', DEFAULT_API_LATEST)
+
+
+def parse_version(value: str) -> tuple:
+    """Parse semver-ish tags like v2.3.0 / 2.3.0-beta into a comparable tuple."""
+    raw = (value or '').strip()
+    if not raw:
+        return (0, 0, 0, 1, '')
+    raw = raw.lstrip('vV')
+    main, _, pre = raw.partition('-')
+    parts = []
+    for piece in main.split('.'):
+        if piece.isdigit():
+            parts.append(int(piece))
+        else:
+            m = re.match(r'(\d+)', piece or '')
+            parts.append(int(m.group(1)) if m else 0)
+    while len(parts) < 3:
+        parts.append(0)
+    # release > prerelease: empty pre sorts higher
+    pre_rank = 0 if not pre else 1
+    return (parts[0], parts[1], parts[2], pre_rank, pre)
+
+
+def version_gt(a: str, b: str) -> bool:
+    return parse_version(a) > parse_version(b)
+
+
+def _run(cmd: list, cwd: str, timeout: int = 120) -> tuple[int, str, str]:
+    try:
+        proc = subprocess.run(
+            cmd,
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            encoding='utf-8',
+            errors='replace',
+        )
+        return proc.returncode, (proc.stdout or '').strip(), (proc.stderr or '').strip()
+    except FileNotFoundError:
+        return 127, '', f'Command not found: {cmd[0]}'
+    except subprocess.TimeoutExpired:
+        return 124, '', f'Timeout running: {" ".join(cmd)}'
+
+
+class UpdateManager:
+    def __init__(self, app_root: str, current_version: str):
+        self.app_root = os.path.abspath(app_root)
+        self.current_version = current_version
+
+    def detect_mode(self) -> dict:
+        frozen = bool(getattr(sys, 'frozen', False))
+        in_docker = os.path.exists('/.dockerenv') or os.environ.get('PANEL_IN_DOCKER') == '1'
+        git_dir = os.path.join(self.app_root, '.git')
+        is_git = os.path.isdir(git_dir)
+        git_ok = False
+        if is_git and not frozen:
+            code, _, _ = _run(['git', '--version'], self.app_root, timeout=10)
+            git_ok = code == 0
+        can_auto = bool(git_ok and not frozen)
+        mode = 'git' if can_auto else ('docker' if in_docker else ('binary' if frozen else 'manual'))
+        return {
+            'mode': mode,
+            'can_auto_update': can_auto,
+            'is_git': is_git,
+            'frozen': frozen,
+            'in_docker': in_docker,
+            'app_root': self.app_root,
+            'repo_url': repo_url(),
+            'git_url': git_url(),
+        }
+
+    def _ensure_update_remote(self) -> Optional[str]:
+        code, out, err = _run(['git', 'remote'], self.app_root, timeout=15)
+        if code != 0:
+            return err or out or 'git remote failed'
+        remotes = set((out or '').split())
+        target = git_url()
+        if UPDATE_REMOTE in remotes:
+            code, _, err = _run(
+                ['git', 'remote', 'set-url', UPDATE_REMOTE, target],
+                self.app_root,
+                timeout=15,
+            )
+        else:
+            code, _, err = _run(
+                ['git', 'remote', 'add', UPDATE_REMOTE, target],
+                self.app_root,
+                timeout=15,
+            )
+        if code != 0:
+            return err or 'Failed to configure update remote'
+        return None
+
+    def working_tree_dirty(self) -> bool:
+        code, out, _ = _run(['git', 'status', '--porcelain'], self.app_root, timeout=30)
+        return code == 0 and bool(out.strip())
+
+    def apply_update(self, target_version: str, allow_dirty: bool = False) -> dict:
+        mode = self.detect_mode()
+        if not mode['can_auto_update']:
+            return {
+                'status': 'error',
+                'message': (
+                    'Auto-update requires a git checkout of the panel sources. '
+                    'Docker/binary installs: pull a new image or download a release manually.'
+                ),
+                'mode': mode,
+            }
+
+        target = (target_version or '').strip()
+        if not re.match(r'^v?\d+(\.\d+){0,3}([.-][\w.]+)?$', target):
+            return {'status': 'error', 'message': f'Invalid target version: {target_version}'}
+        if not target.startswith('v'):
+            target = 'v' + target
+
+        if not allow_dirty and self.working_tree_dirty():
+            return {
+                'status': 'error',
+                'message': (
+                    'Working tree has local changes. Commit/stash them or set allow_dirty, '
+                    'then retry auto-update.'
+                ),
+            }
+
+        err = self._ensure_update_remote()
+        if err:
+            return {'status': 'error', 'message': err}
+
+        code, out, stderr = _run(
+            ['git', 'fetch', '--tags', '--force', UPDATE_REMOTE],
+            self.app_root,
+            timeout=180,
+        )
+        if code != 0:
+            return {
+                'status': 'error',
+                'message': f'git fetch failed: {stderr or out or code}',
+            }
+
+        # Prefer annotated/lightweight tag; fall back to remote main tip if tag missing
+        code, _, _ = _run(
+            ['git', 'rev-parse', '-q', '--verify', f'refs/tags/{target}'],
+            self.app_root,
+            timeout=15,
+        )
+        if code == 0:
+            checkout_ref = target
+        else:
+            # tag might only exist as FETCH_HEAD / remote tag
+            code2, _, _ = _run(
+                ['git', 'rev-parse', '-q', '--verify', f'refs/tags/{target}^{{}}'],
+                self.app_root,
+                timeout=15,
+            )
+            checkout_ref = target if code2 == 0 else f'tags/{target}'
+
+        code, out, stderr = _run(
+            ['git', 'checkout', '--force', checkout_ref],
+            self.app_root,
+            timeout=60,
+        )
+        if code != 0:
+            # last resort: checkout remote main
+            code_m, out_m, err_m = _run(
+                ['git', 'checkout', '--force', '-B', 'main', f'{UPDATE_REMOTE}/main'],
+                self.app_root,
+                timeout=60,
+            )
+            if code_m != 0:
+                return {
+                    'status': 'error',
+                    'message': f'git checkout {target} failed: {stderr or out or err_m or out_m}',
+                }
+            checkout_ref = f'{UPDATE_REMOTE}/main'
+
+        req = os.path.join(self.app_root, 'requirements.txt')
+        pip_log = ''
+        if os.path.isfile(req):
+            code_p, out_p, err_p = _run(
+                [sys.executable, '-m', 'pip', 'install', '-r', req],
+                self.app_root,
+                timeout=300,
+            )
+            pip_log = (out_p or err_p or '')[:1500]
+            if code_p != 0:
+                return {
+                    'status': 'error',
+                    'message': f'pip install failed after checkout: {err_p or out_p or code_p}',
+                    'checkout': checkout_ref,
+                }
+
+        return {
+            'status': 'success',
+            'message': f'Updated to {target}. Panel will restart.',
+            'target_version': target,
+            'checkout': checkout_ref,
+            'pip': pip_log[:500],
+            'restart': True,
+        }
+
+    @staticmethod
+    def schedule_restart(delay_sec: float = 1.5) -> None:
+        def _restart():
+            time.sleep(max(0.5, float(delay_sec)))
+            try:
+                argv = [sys.executable] + sys.argv
+                logger.info('Restarting panel after update: %s', argv)
+                os.execv(sys.executable, argv)
+            except Exception:
+                logger.exception('Failed to restart after update; exiting')
+                os._exit(0)
+
+        threading.Thread(target=_restart, name='panel-update-restart', daemon=False).start()

static/css/style.css

@@ -944,6 +944,11 @@ a:hover {
     color: #38bdf8;
 }
 
+.protocol-hysteria .protocol-icon {
+    background: linear-gradient(135deg, rgba(14, 165, 233, 0.2), rgba(99, 102, 241, 0.1));
+    color: #38bdf8;
+}
+
 .protocol-dns .protocol-icon {
     background: linear-gradient(135deg, rgba(34, 197, 94, 0.2), rgba(16, 185, 129, 0.1));
     color: var(--success);

telegram_bot.py

@@ -24,7 +24,7 @@ _bot_task: Optional[asyncio.Task] = None
 _callback_refs = {}
 _pending_inputs = {}
 
-CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "wireguard"}
+CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "hysteria", "naiveproxy", "wireguard"}
 SERVICE_PROTOCOLS = {"dns", "adguard", "socks5", "nginx"}
 
 
@@ -137,6 +137,8 @@ def _protocol_display_name(protocol: str) -> str:
         "awg_legacy": "AmneziaWG Legacy",
         "xray": "Xray",
         "telemt": "Telemt",
+        "hysteria": "Hysteria 2",
+        "naiveproxy": "NaiveProxy",
         "dns": "AmneziaDNS",
         "wireguard": "WireGuard",
         "socks5": "SOCKS5",
@@ -338,6 +340,8 @@ def _get_ssh_and_manager(server: dict, proto: str):
     from managers.awg_manager import AWGManager
     from managers.xray_manager import XrayManager
     from managers.telemt_manager import TelemtManager
+    from managers.hysteria_manager import HysteriaManager
+    from managers.naiveproxy_manager import NaiveProxyManager
     from managers.wireguard_manager import WireGuardManager
     from managers.dns_manager import DNSManager
     from managers.socks5_manager import Socks5Manager
@@ -356,6 +360,10 @@ def _get_ssh_and_manager(server: dict, proto: str):
         manager = XrayManager(ssh, proto)
     elif base == "telemt":
         manager = TelemtManager(ssh, proto)
+    elif base == "hysteria":
+        manager = HysteriaManager(ssh, proto)
+    elif base == "naiveproxy":
+        manager = NaiveProxyManager(ssh, proto)
     elif base == "wireguard":
         manager = WireGuardManager(ssh)
     elif base == "dns":
@@ -561,7 +569,7 @@ async def _send_config_by_client(api: TelegramAPI, chat_id: int, server: dict, p
         server_name = server.get("name") or server.get("host", "Unknown")
         await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server_name)}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
 
-        is_link_proto = _proto_base(proto) in ("xray", "telemt")
+        is_link_proto = _proto_base(proto) in ("xray", "telemt", "hysteria", "naiveproxy")
         if is_link_proto:
             await api.send_message(chat_id, f"🔗 <b>Connection link</b> (tap to copy):\n<code>{_e(config)}</code>")
         else:
@@ -918,7 +926,7 @@ async def _admin_create_client(api: TelegramAPI, chat_id: int, message_id: int,
 
 async def _send_config_text(api: TelegramAPI, chat_id: int, server: dict, proto: str, conn_name: str, config: str, generate_vpn_link_fn: Callable):
     await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server.get('name') or server.get('host'))}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
-    if _proto_base(proto) in ("xray", "telemt"):
+    if _proto_base(proto) in ("xray", "telemt", "hysteria", "naiveproxy"):
         await api.send_message(chat_id, f"🔗 <b>Connection link</b>:\n<code>{_e(config)}</code>")
     else:
         await api.send_message(chat_id, f"<b>📄 Configuration:</b>\n<pre>{_e(config)}</pre>")

templates/guest.html

@@ -105,6 +105,9 @@
         if (p === 'awg_legacy') return 'AWG Legacy';
         if (p === 'xray') return 'Xray';
         if (p === 'xui') return '3x-ui VLESS';
+        if (p === 'hysteria') return 'Hysteria 2';
+        if (p === 'naiveproxy') return 'NaiveProxy';
+        if (p === 'telemt') return 'Telemt';
         return (p || '').toUpperCase();
     }
 

templates/index.html

@@ -19,6 +19,8 @@
         <div class="card card-hover server-card" id="server-{{ loop.index0 }}" data-idx="{{ loop.index0 }}"
             data-name="{{ server.name }}" data-host="{{ server.host }}" data-port="{{ server.ssh_port }}"
             data-username="{{ server.username }}" data-auth="{{ 'key' if server.private_key else 'password' }}"
+            data-ssl-domain="{{ (server.server_info or {}).get('ssl_domain', '') }}"
+            data-ssl-email="{{ (server.server_info or {}).get('ssl_email', '') }}"
             draggable="true">
             <div class="server-meta">
                 <div class="server-icon">{{ icon('server') }}</div>
@@ -137,6 +139,16 @@
                 </div>
             </div>
 
+            <div class="form-group" style="margin-top: var(--space-md)">
+                <label class="form-label">{{ _('server_ssl_domain') }}</label>
+                <input class="form-input" type="text" id="editServerSslDomain" placeholder="vpn.example.com">
+                <div class="form-hint">{{ _('server_ssl_hint') }}</div>
+            </div>
+            <div class="form-group">
+                <label class="form-label">{{ _('server_ssl_email') }}</label>
+                <input class="form-input" type="email" id="editServerSslEmail" placeholder="admin@example.com">
+            </div>
+
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" onclick="closeModal('editServerModal')">{{ _('cancel')
                     }}</button>
@@ -202,6 +214,16 @@
                 </div>
             </div>
 
+            <div class="form-group" style="margin-top: var(--space-md)">
+                <label class="form-label">{{ _('server_ssl_domain') }}</label>
+                <input class="form-input" type="text" id="serverSslDomain" placeholder="vpn.example.com">
+                <div class="form-hint">{{ _('server_ssl_hint') }}</div>
+            </div>
+            <div class="form-group">
+                <label class="form-label">{{ _('server_ssl_email') }}</label>
+                <input class="form-input" type="email" id="serverSslEmail" placeholder="admin@example.com">
+            </div>
+
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" onclick="closeModal('addServerModal')">{{ _('cancel')
                     }}</button>
@@ -244,6 +266,8 @@
                 username: document.getElementById('serverUser').value,
                 password: document.getElementById('serverPassword').value,
                 private_key: document.getElementById('serverKey').value,
+                ssl_domain: document.getElementById('serverSslDomain').value.trim(),
+                ssl_email: document.getElementById('serverSslEmail').value.trim(),
             };
 
             const result = await apiCall('/api/servers/add', 'POST', data);
@@ -292,6 +316,8 @@
         document.getElementById('editServerUser').value = card.dataset.username || '';
         document.getElementById('editServerPassword').value = '';
         document.getElementById('editServerKey').value = '';
+        document.getElementById('editServerSslDomain').value = card.dataset.sslDomain || '';
+        document.getElementById('editServerSslEmail').value = card.dataset.sslEmail || '';
 
         // Pre-select the tab matching the server's current auth method.
         const authIsKey = card.dataset.auth === 'key';
@@ -321,6 +347,8 @@
                 // Empty -> null means "leave unchanged" on the backend.
                 password: document.getElementById('editServerPassword').value || null,
                 private_key: document.getElementById('editServerKey').value || null,
+                ssl_domain: document.getElementById('editServerSslDomain').value.trim(),
+                ssl_email: document.getElementById('editServerSslEmail').value.trim(),
             };
             await apiCall(`/api/servers/${idx}/edit`, 'POST', body);
             showToast(_('server_saved'), 'success');

templates/invites.html

@@ -127,17 +127,22 @@
         </div>
 
         <div class="form-group">
+            <label class="form-label">{{ _('server_label') }}</label>
+            <select class="form-select" id="inviteServer" onchange="onInviteServerChange()">
+                {% if xui_configured %}
+                <option value="xui">3x-ui</option>
+                {% endif %}
+                {% for s in servers %}
+                <option value="{{ loop.index0 }}">{{ s.name or s.host }} ({{ s.host }})</option>
+                {% endfor %}
+            </select>
+            <div class="form-hint">{{ _('server_then_protocol_hint') }}</div>
+        </div>
+
+        <div class="form-group" id="inviteProtoGroup">
             <label class="form-label">{{ _('protocol_label') }}</label>
             <select class="form-select" id="inviteProtocol" onchange="updateInviteProtoFields()">
-                <option value="xui">3x-ui VLESS</option>
-                {% for s in servers %}
-                {% set server_idx = loop.index0 %}
-                {% for key, info in (s.protocols or {}).items() %}
-                {% if info.installed and key.split('__')[0] in ['awg','awg2','awg_legacy','xray','wireguard','telemt'] %}
-                <option value="{{ key }}|{{ server_idx }}">{{ s.name or s.host }} — {{ key }}</option>
-                {% endif %}
-                {% endfor %}
-                {% endfor %}
+                <!-- filled by JS from selected server -->
             </select>
         </div>
 
@@ -187,9 +192,30 @@
 
 <script>
     const invitesData = {{ invites | tojson }};
+    const serversData = {{ servers | tojson }};
     const xuiConfigured = {{ 'true' if xui_configured else 'false' }};
     const xuiDefaultInbound = {{ xui_default_inbound | int }};
     const xuiDefaultPanelId = {{ (xui_default_panel_id or '') | tojson }};
+    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy'];
+    const PROTO_TITLES = {
+        awg2: 'AmneziaWG 2.0',
+        awg: 'AmneziaWG',
+        awg_legacy: 'AWG Legacy',
+        wireguard: 'WireGuard',
+        xray: 'Xray (VLESS-Reality)',
+        telemt: 'Telemt',
+        hysteria: 'Hysteria 2',
+        naiveproxy: 'NaiveProxy',
+        xui: '3x-ui VLESS',
+    };
+
+    function protoTitle(key) {
+        const raw = String(key || '');
+        const base = raw.split('__')[0];
+        const title = PROTO_TITLES[base] || base.toUpperCase();
+        const m = raw.match(/__(\d+)$/);
+        return m ? `${title} #${m[1]}` : title;
+    }
 
     function inviteUrl(token) {
         return `${window.location.origin}/invite/${token}`;
@@ -200,6 +226,57 @@
         showToast(_('copied'), 'success');
     }
 
+    function fillInviteProtocols(preferProtocol) {
+        const serverVal = document.getElementById('inviteServer').value;
+        const sel = document.getElementById('inviteProtocol');
+        sel.innerHTML = '';
+
+        if (serverVal === 'xui') {
+            const opt = document.createElement('option');
+            opt.value = 'xui';
+            opt.textContent = PROTO_TITLES.xui;
+            sel.appendChild(opt);
+            updateInviteProtoFields();
+            return;
+        }
+
+        const server = serversData[parseInt(serverVal, 10)];
+        const protocols = (server && server.protocols) || {};
+        const installed = Object.keys(protocols).filter(k => {
+            const info = protocols[k] || {};
+            if (!info.installed) return false;
+            return VPN_PROTO_ORDER.includes(k.split('__')[0]);
+        });
+        installed.sort((a, b) => {
+            const ia = VPN_PROTO_ORDER.indexOf(a.split('__')[0]);
+            const ib = VPN_PROTO_ORDER.indexOf(b.split('__')[0]);
+            return (ia < 0 ? 99 : ia) - (ib < 0 ? 99 : ib) || a.localeCompare(b);
+        });
+
+        if (!installed.length) {
+            const opt = document.createElement('option');
+            opt.value = '';
+            opt.textContent = _('no_protocols');
+            opt.disabled = true;
+            sel.appendChild(opt);
+            updateInviteProtoFields();
+            return;
+        }
+
+        installed.forEach(key => {
+            const opt = document.createElement('option');
+            opt.value = key;
+            opt.textContent = protoTitle(key);
+            if (preferProtocol && preferProtocol === key) opt.selected = true;
+            sel.appendChild(opt);
+        });
+        updateInviteProtoFields();
+    }
+
+    function onInviteServerChange() {
+        fillInviteProtocols();
+    }
+
     function updateInviteProtoFields() {
         const v = document.getElementById('inviteProtocol').value;
         document.getElementById('inviteInboundGroup').style.display = (v === 'xui') ? '' : 'none';
@@ -237,25 +314,26 @@
         }
     }
 
-    function parseProtocolValue() {
-        const raw = document.getElementById('inviteProtocol').value;
-        if (raw === 'xui') return { protocol: 'xui', server_id: 0 };
-        if (raw.includes('|')) {
-            const [protocol, sid] = raw.split('|');
-            return { protocol, server_id: parseInt(sid || '0') };
+    function parseInviteSelection() {
+        const serverVal = document.getElementById('inviteServer').value;
+        const protocol = document.getElementById('inviteProtocol').value;
+        if (serverVal === 'xui' || protocol === 'xui') {
+            return { protocol: 'xui', server_id: 0 };
         }
-        return { protocol: raw, server_id: 0 };
+        return { protocol, server_id: parseInt(serverVal || '0', 10) || 0 };
     }
 
-    function setProtocolSelect(protocol, serverId) {
-        const sel = document.getElementById('inviteProtocol');
-        if (protocol === 'xui') sel.value = 'xui';
-        else {
-            const want = `${protocol}|${serverId || 0}`;
-            if ([...sel.options].some(o => o.value === want)) sel.value = want;
-            else sel.value = 'xui';
+    function setInviteSelection(protocol, serverId) {
+        const serverSel = document.getElementById('inviteServer');
+        if (protocol === 'xui') {
+            if ([...serverSel.options].some(o => o.value === 'xui')) serverSel.value = 'xui';
+            fillInviteProtocols('xui');
+            return;
         }
-        updateInviteProtoFields();
+        const sid = String(serverId || 0);
+        if ([...serverSel.options].some(o => o.value === sid)) serverSel.value = sid;
+        else if (serverSel.options.length) serverSel.selectedIndex = xuiConfigured ? 1 : 0;
+        fillInviteProtocols(protocol);
     }
 
     function openCreateInvite() {
@@ -269,12 +347,17 @@
         document.getElementById('inviteNote').value = '';
         document.getElementById('inviteClearPwdWrap').style.display = 'none';
         document.getElementById('inviteResetUsedWrap').style.display = 'none';
-        setProtocolSelect('xui', 0);
+        const serverSel = document.getElementById('inviteServer');
+        if (xuiConfigured && [...serverSel.options].some(o => o.value === 'xui')) serverSel.value = 'xui';
+        else if (serverSel.options.length) serverSel.selectedIndex = 0;
+        fillInviteProtocols();
         if (xuiDefaultPanelId) {
             const p = document.getElementById('inviteXuiPanel');
             if (p && [...p.options].some(o => o.value === xuiDefaultPanelId)) p.value = xuiDefaultPanelId;
         }
+        if (document.getElementById('inviteProtocol').value === 'xui') {
             loadInviteInbounds(xuiDefaultInbound);
+        }
         openModal('inviteModal');
     }
 
@@ -293,12 +376,14 @@
         document.getElementById('inviteClearPassword').checked = false;
         document.getElementById('inviteResetUsedWrap').style.display = 'block';
         document.getElementById('inviteResetUsed').checked = false;
-        setProtocolSelect(inv.protocol || 'xui', inv.server_id || 0);
+        setInviteSelection(inv.protocol || 'xui', inv.server_id || 0);
         const panelSel = document.getElementById('inviteXuiPanel');
         if (panelSel && inv.xui_panel_id && [...panelSel.options].some(o => o.value === inv.xui_panel_id)) {
             panelSel.value = inv.xui_panel_id;
         }
+        if ((inv.protocol || '') === 'xui') {
             loadInviteInbounds(inv.xui_inbound_id || xuiDefaultInbound);
+        }
         openModal('inviteModal');
     }
 
@@ -309,7 +394,8 @@
         spinner.classList.remove('hidden');
         try {
             const editId = document.getElementById('inviteEditId').value;
-            const proto = parseProtocolValue();
+            const proto = parseInviteSelection();
+            if (!proto.protocol) throw new Error(_('no_protocols'));
             const inbound = parseInt(document.getElementById('inviteInboundId').value || '0');
             if (proto.protocol === 'xui' && !inbound) throw new Error(_('invite_inbound_required'));
 

templates/my_connections.html

@@ -118,10 +118,11 @@
                 document.getElementById('configText').textContent = result.config;
                 document.getElementById('vpnLinkText').textContent = currentVpnLink;
 
-                // Telemt uses share links, not vpn:// Amnezia format
+                // Telemt / Hysteria / NaiveProxy use share links, not vpn:// Amnezia format
                 const vpnTab = document.querySelectorAll('.config-tab')[1];
                 const vpnPanel = document.getElementById('panel-vpn');
-                if (proto === 'telemt') {
+                const base = String(proto || '').split('__')[0];
+                if (proto === 'telemt' || base === 'hysteria' || base === 'naiveproxy') {
                     vpnTab.style.display = 'none';
                 } else {
                     vpnTab.style.display = '';

templates/server.html

@@ -1,4 +1,4 @@
-{% extends "base.html" %}
+{% extends "base.html" %}
 {% from "macros/icons.html" import icon %}
 
 {% block title_extra %} — {{ server.name }}{% endblock %}
@@ -295,6 +295,55 @@
         </div>
     </div>
 
+    <!-- Hysteria Card -->
+    <div class="card card-hover protocol-card protocol-hysteria" id="proto-hysteria">
+        <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
+            <div class="protocol-icon">{{ icon('refresh') }}</div>
+            <div class="flex gap-sm" id="hysteria-ctrl" style="display:none!important;"></div>
+        </div>
+        <div class="protocol-name">Hysteria 2</div>
+        <div class="protocol-desc">
+            {{ _('hysteria_desc') }}
+        </div>
+        <div class="protocol-status" id="hysteria-status">
+            <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
+        </div>
+        <div id="hysteria-info" class="hidden">
+            <div class="protocol-info" id="hysteria-info-grid"></div>
+        </div>
+        <div class="flex gap-sm" id="hysteria-actions">
+            <button class="btn btn-primary btn-sm" onclick="openInstallModal('hysteria')" id="hysteria-install-btn"
+                style="flex:1">
+                {{ _('install') }}
+            </button>
+        </div>
+    </div>
+
+    <!-- NaiveProxy Card -->
+    <div class="card card-hover protocol-card protocol-naiveproxy" id="proto-naiveproxy">
+        <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
+            <div class="protocol-icon">{{ icon('link') }}</div>
+            <div class="flex gap-sm" id="naiveproxy-ctrl" style="display:none!important;"></div>
+        </div>
+            <div class="protocol-name">NaiveProxy <span
+                style="font-size:0.65rem; background:var(--success, #16a34a); color:#fff; padding:2px 6px; border-radius:8px; vertical-align:middle;">STABLE</span></div>
+            <div class="protocol-desc">
+                {{ _('naiveproxy_desc') }}
+            </div>
+        <div class="protocol-status" id="naiveproxy-status">
+            <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
+        </div>
+        <div id="naiveproxy-info" class="hidden">
+            <div class="protocol-info" id="naiveproxy-info-grid"></div>
+        </div>
+        <div class="flex gap-sm" id="naiveproxy-actions">
+            <button class="btn btn-primary btn-sm" onclick="openInstallModal('naiveproxy')" id="naiveproxy-install-btn"
+                style="flex:1">
+                {{ _('install') }}
+            </button>
+        </div>
+    </div>
+
     <!-- WireGuard Card -->
     <div class="card card-hover protocol-card protocol-wireguard" id="proto-wireguard">
         <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
@@ -657,6 +706,47 @@
                 <div class="form-hint">{{ _('nginx_install_hint') }}</div>
             </div>
 
+            <div id="hysteriaOptions"
+                style="display:none; padding: var(--space-md); background: rgba(0,0,0,0.03); border-radius: var(--radius-md); margin-bottom: var(--space-md);">
+                <div class="form-hint" style="margin-bottom: var(--space-md); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35); color: var(--text);">
+                    {{ _('hysteria_ports_warning') }}
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('port') }} (UDP) *</label>
+                    <input class="form-input" type="number" id="installHysteriaPort" value="8998" min="1" max="65535">
+                    <div class="form-hint">{{ _('hysteria_port_hint') }}</div>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('hysteria_domain') }}</label>
+                    <input class="form-input" type="text" id="installHysteriaDomain" placeholder="vpn.example.com" oninput="updateHysteriaDnsHint()">
+                    <div class="form-hint" id="hysteriaDnsHint"></div>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('hysteria_email') }}</label>
+                    <input class="form-input" type="email" id="installHysteriaEmail" placeholder="admin@example.com">
+                </div>
+                <div class="form-hint">{{ _('hysteria_install_hint') }}</div>
+            </div>
+
+            <div id="naiveproxyOptions"
+                style="display:none; padding: var(--space-md); background: rgba(0,0,0,0.03); border-radius: var(--radius-md); margin-bottom: var(--space-md);">
+                <div class="form-hint" style="margin-bottom: var(--space-md); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35); color: var(--text);">
+                    {{ _('naiveproxy_ports_warning') }}
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('naiveproxy_domain') }}</label>
+                    <input class="form-input" type="text" id="installNaiveproxyDomain" placeholder="vpn.example.com" oninput="updateNaiveproxyDnsHint()">
+                    <div class="form-hint" id="naiveproxyDnsHint"></div>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('naiveproxy_email') }}</label>
+                    <input class="form-input" type="email" id="installNaiveproxyEmail" placeholder="admin@example.com">
+                </div>
+                <div class="form-hint">{{ _('naiveproxy_install_hint') }}</div>
+                <div class="form-hint" style="margin-top: var(--space-sm);">{{ _('naiveproxy_port_hint') }}</div>
+                <div class="form-hint" style="margin-top: var(--space-sm); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">{{ _('naiveproxy_client_hint') }}</div>
+            </div>
+
             <div class="modal-footer">
                 <button class="btn btn-secondary" onclick="closeModal('installModal')">{{ _('cancel') }}</button>
                 <button class="btn btn-primary" onclick="installProtocol()" id="installBtn">
@@ -711,6 +801,45 @@
     </div>
 </div>
 
+<!-- ===== Hysteria Settings Modal ===== -->
+<div class="modal-backdrop" id="hysteriaSettingsModal">
+    <div class="modal">
+        <div class="modal-header">
+            <h2 class="modal-title" id="hysteriaSettingsTitle">{{ _('hysteria_settings_title') }}</h2>
+            <button class="modal-close" onclick="closeModal('hysteriaSettingsModal')">×</button>
+        </div>
+        <input type="hidden" id="hysteriaSetProto" value="hysteria" />
+        <div class="form-hint" style="margin-bottom: var(--space-md); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">
+            {{ _('hysteria_ports_warning') }}
+        </div>
+        <div class="form-group">
+            <label class="form-label">{{ _('hysteria_domain') }}</label>
+            <input class="form-input" type="text" id="hysteriaSetDomain" placeholder="vpn.example.com">
+            <div class="form-hint">{{ _('hysteria_ssl_change_hint') }}</div>
+        </div>
+        <div class="form-group">
+            <label class="form-label">{{ _('hysteria_email') }}</label>
+            <input class="form-input" type="email" id="hysteriaSetEmail" placeholder="admin@example.com">
+        </div>
+        <div class="form-group">
+            <label class="form-label">{{ _('port') }} (UDP)</label>
+            <input class="form-input" type="number" id="hysteriaSetPort" min="1" max="65535" value="8998">
+            <div class="form-hint">{{ _('hysteria_port_change_hint') }}</div>
+        </div>
+        <div class="modal-footer" style="flex-wrap: wrap; gap: var(--space-sm);">
+            <button class="btn btn-secondary" onclick="closeModal('hysteriaSettingsModal')">{{ _('cancel') }}</button>
+            <button class="btn btn-secondary" onclick="renewHysteriaSsl()" id="hysteriaRenewBtn">
+                <span id="hysteriaRenewBtnText">{{ _('hysteria_renew_ssl') }}</span>
+                <div class="spinner hidden" id="hysteriaRenewSpinner"></div>
+            </button>
+            <button class="btn btn-primary" onclick="saveHysteriaSettings()" id="hysteriaSaveBtn">
+                <span id="hysteriaSaveBtnText">{{ _('save') }}</span>
+                <div class="spinner hidden" id="hysteriaSaveSpinner"></div>
+            </button>
+        </div>
+    </div>
+</div>
+
 <!-- ===== NGINX Site Modal ===== -->
 <div class="modal-backdrop" id="siteConfigModal">
     <div class="modal" style="max-width:680px;">
@@ -859,6 +988,7 @@
         <div class="config-panel active" id="panel-conf">
             <div class="config-display">
                 <div class="config-text" id="configText"></div>
+                <div class="form-hint hidden" id="configClientHint" style="margin-top: var(--space-sm);"></div>
                 <div class="config-actions">
                     <button class="btn btn-secondary btn-sm" onclick="copyToClipboard(currentConfig)" style="flex:1">
                         {{ _('copy') }}
@@ -961,12 +1091,16 @@
 <script>
     const SERVER_ID = {{ server_id }};
     const SERVER_HOST = "{{ server.host }}";
+    const SERVER_SSL_DOMAIN = {{ ((server.server_info or {}).get('ssl_domain') or '') | tojson }};
+    const SERVER_SSL_EMAIL = {{ ((server.server_info or {}).get('ssl_email') or '') | tojson }};
     const MARKETPLACE_APPS = [
         { proto: 'awg2', category: 'protocols', icon: 'sparkles', title: 'AmneziaWG 2.0', descKey: 'awg_desc', badge: 'NEW' },
         { proto: 'awg', category: 'protocols', icon: 'shield', title: 'AmneziaWG', descKey: 'awg_desc' },
         { proto: 'awg_legacy', category: 'protocols', icon: 'radio', title: 'AmneziaWG Legacy', descKey: 'awg_legacy_desc' },
         { proto: 'xray', category: 'protocols', icon: 'zap', title: 'Xray (VLESS-Reality)', descKey: 'xray_desc' },
         { proto: 'telemt', category: 'protocols', icon: 'plane', title: 'Telemt (Telegram Proxy)', descKey: 'telemt_desc' },
+        { proto: 'hysteria', category: 'protocols', icon: 'refresh', title: 'Hysteria 2', descKey: 'hysteria_desc' },
+        { proto: 'naiveproxy', category: 'protocols', icon: 'link', title: 'NaiveProxy', descKey: 'naiveproxy_desc', badge: 'STABLE' },
         { proto: 'wireguard', category: 'protocols', icon: 'lock', title: 'WireGuard', descKey: 'wireguard_desc' },
         { proto: 'dns', category: 'services', icon: 'search', title: 'AmneziaDNS', descKey: 'dns_desc' },
         { proto: 'adguard', category: 'services', icon: 'shield-check', title: 'AdGuard Home', descKey: 'adguard_desc' },
@@ -1002,7 +1136,7 @@
     }
 
     function isMultiInstanceBase(proto) {
-        return ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'socks5'].includes(protoBase(proto));
+        return ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'].includes(protoBase(proto));
     }
 
     function nextSuggestedPort(base, fallback) {
@@ -1207,6 +1341,8 @@
             case 'awg_legacy': title = 'AmneziaWG Legacy'; break;
             case 'xray': title = 'Xray'; break;
             case 'telemt': title = 'Telemt'; break;
+            case 'hysteria': title = 'Hysteria 2'; break;
+            case 'naiveproxy': title = 'NaiveProxy'; break;
             case 'wireguard': title = 'WireGuard'; break;
             case 'dns': title = 'AmneziaDNS'; break;
             case 'socks5': title = 'SOCKS5 Proxy'; break;
@@ -1266,7 +1402,7 @@
 
                 for (const [proto, info] of orderedProtocolEntries(data.protocols)) {
                     updateProtocolCard(proto, info);
-                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard'].includes(protoBase(proto));
+                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'wireguard'].includes(protoBase(proto));
                     if (info.container_running && isVPN) {
                         const opt = document.createElement('option');
                         opt.value = proto;
@@ -1494,7 +1630,13 @@
                 if (isService) {
                     grid = buildServiceInfoGrid(proto, info);
                 } else if (info.port) {
-                    grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('port')}</span><span class="protocol-info-value">${info.port}/${(['xray', 'telemt'].includes(protoBase(proto))) ? 'TCP' : 'UDP'}</span></div>`;
+                    grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('port')}</span><span class="protocol-info-value">${info.port}/${(['xray', 'telemt', 'naiveproxy'].includes(protoBase(proto))) ? 'TCP' : 'UDP'}</span></div>`;
+                    if (protoBase(proto) === 'hysteria' && info.domain) {
+                        grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('hysteria_domain')}</span><span class="protocol-info-value">${info.domain}</span></div>`;
+                    }
+                    if (protoBase(proto) === 'naiveproxy' && info.domain) {
+                        grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('naiveproxy_domain')}</span><span class="protocol-info-value">${info.domain}</span></div>`;
+                    }
                 }
                 if (!isService && info.clients_count !== undefined) {
                     grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('connections')}</span><span class="protocol-info-value">${info.clients_count}</span></div>`;
@@ -1529,6 +1671,21 @@
                     <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')" style="flex:1">${_('backup')}</button>
                     <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
                 `;
+            } else if (protoBase(proto) === 'hysteria') {
+                actionsEl.innerHTML = `
+                    <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="openHysteriaSettings('${proto}')">${_('hysteria_change_port')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')">${_('backup')}</button>
+                    <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
+                `;
+                showConnectionsSection();
+            } else if (protoBase(proto) === 'naiveproxy') {
+                actionsEl.innerHTML = `
+                    <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')">${_('backup')}</button>
+                    <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
+                `;
+                showConnectionsSection();
             } else {
                 actionsEl.innerHTML = `
                     <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
@@ -1565,6 +1722,7 @@
         } else if (info.container_exists) {
             installedProtocols[proto] = true;
             const errText = String(info.error || '').trim();
+            const portBusy = !!info.port_busy || /address already in use|UDP port \d+ already in use|already in use/i.test(errText);
             statusEl.innerHTML = errText
                 ? `<span class="badge badge-danger" style="max-width:100%; white-space:normal; text-align:left; line-height:1.35;"><span class="badge-dot"></span> ${_('stop')}: ${escapeHtml(errText.slice(0, 120))}</span>`
                 : `<span class="badge badge-danger"><span class="badge-dot"></span> ${_('stop')}</span>`;
@@ -1583,6 +1741,25 @@
                 if (errText) {
                     grid += `<div class="protocol-info-item" style="grid-column:1/-1;"><span class="protocol-info-label">${_('error')}</span><span class="protocol-info-value" style="color:var(--danger); word-break:break-word;">${escapeHtml(errText)}</span></div>`;
                 }
+                if (protoBase(proto) === 'hysteria') {
+                    const curPort = parseInt(info.port, 10) || 443;
+                    const suggest = (curPort === 443 || portBusy) ? 8998 : curPort;
+                    grid += `
+                        <div class="protocol-info-item" style="grid-column:1/-1; display:block; padding-top:8px;">
+                            <span class="protocol-info-label" style="display:block; margin-bottom:6px;">${_('hysteria_change_port')} (UDP)</span>
+                            <div style="display:flex; gap:8px; flex-wrap:wrap; align-items:center;">
+                                <input class="form-input" type="number" id="hysteriaInlinePort-${protoDomKey(proto)}"
+                                    value="${suggest}" min="1" max="65535" style="width:120px; flex:0 0 auto;">
+                                <button class="btn btn-primary btn-sm" type="button"
+                                    onclick="applyHysteriaPort('${proto}', document.getElementById('hysteriaInlinePort-${protoDomKey(proto)}').value)">
+                                    ${_('save')} &amp; ${_('start_btn')}
+                                </button>
+                                <button class="btn btn-secondary btn-sm" type="button" onclick="openHysteriaSettings('${proto}')">${_('hysteria_settings_title')}</button>
+                            </div>
+                            <div class="form-hint" style="margin-top:6px;">${_('hysteria_port_change_hint')}</div>
+                        </div>
+                    `;
+                }
                 infoGrid.innerHTML = grid;
             }
             if (isService) {
@@ -1592,6 +1769,13 @@
                     <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')">${_('backup')}</button>
                     <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
                 `;
+            } else if (protoBase(proto) === 'hysteria') {
+                actionsEl.innerHTML = `
+                    <button class="btn btn-primary btn-sm" onclick="openHysteriaSettings('${proto}')" style="flex:1">${_('hysteria_change_port')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="showContainerLogs('${proto}')">${_('logs_btn')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="openInstallModal('${proto}')">${_('reinstall')}</button>
+                    <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
+                `;
             } else {
                 actionsEl.innerHTML = `
                     <button class="btn btn-primary btn-sm" onclick="openInstallModal('${proto}')" style="flex:1">${_('reinstall')}</button>
@@ -1872,6 +2056,22 @@
         hint.innerHTML = `${_('nginx_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
     }
 
+    function updateHysteriaDnsHint() {
+        const input = document.getElementById('installHysteriaDomain');
+        const hint = document.getElementById('hysteriaDnsHint');
+        if (!input || !hint) return;
+        const domain = (input.value || '').trim() || 'vpn.example.com';
+        hint.innerHTML = `${_('hysteria_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
+    }
+
+    function updateNaiveproxyDnsHint() {
+        const input = document.getElementById('installNaiveproxyDomain');
+        const hint = document.getElementById('naiveproxyDnsHint');
+        if (!input || !hint) return;
+        const domain = (input.value || '').trim() || 'vpn.example.com';
+        hint.innerHTML = `${_('naiveproxy_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
+    }
+
     function openInstallModal(proto, installAnother = false) {
         const base = protoBase(proto);
         currentInstallProto = installAnother ? base : proto;
@@ -1887,11 +2087,15 @@
         const socks5Opts = document.getElementById('socks5Options');
         const adguardOpts = document.getElementById('adguardOptions');
         const nginxOpts = document.getElementById('nginxOptions');
+        const hysteriaOpts = document.getElementById('hysteriaOptions');
+        const naiveproxyOpts = document.getElementById('naiveproxyOptions');
 
         telemtOpts.style.display = 'none';
         socks5Opts.style.display = 'none';
         adguardOpts.style.display = 'none';
         nginxOpts.style.display = 'none';
+        hysteriaOpts.style.display = 'none';
+        if (naiveproxyOpts) naiveproxyOpts.style.display = 'none';
         if (portGroup) portGroup.style.display = '';
 
         if (base === 'dns') {
@@ -1928,7 +2132,37 @@
             portInput.disabled = false;
             portHint.textContent = _('nginx_port_hint');
             nginxOpts.style.display = 'block';
+            const nxDomain = document.getElementById('installNginxDomain');
+            const nxEmail = document.getElementById('installNginxEmail');
+            if (nxDomain && !nxDomain.value && SERVER_SSL_DOMAIN) nxDomain.value = SERVER_SSL_DOMAIN;
+            if (nxEmail && !nxEmail.value && SERVER_SSL_EMAIL) nxEmail.value = SERVER_SSL_EMAIL;
             updateNginxDnsHint();
+        } else if (base === 'hysteria') {
+            if (portGroup) portGroup.style.display = 'none';
+            const suggested = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 8998) : '8998';
+            portInput.value = suggested;
+            portInput.disabled = false;
+            hysteriaOpts.style.display = 'block';
+            const hyPort = document.getElementById('installHysteriaPort');
+            if (hyPort) {
+                hyPort.value = suggested;
+                hyPort.oninput = () => { portInput.value = hyPort.value; };
+            }
+            const hyDomain = document.getElementById('installHysteriaDomain');
+            const hyEmail = document.getElementById('installHysteriaEmail');
+            if (hyDomain && !hyDomain.value && SERVER_SSL_DOMAIN) hyDomain.value = SERVER_SSL_DOMAIN;
+            if (hyEmail && !hyEmail.value && SERVER_SSL_EMAIL) hyEmail.value = SERVER_SSL_EMAIL;
+            updateHysteriaDnsHint();
+        } else if (base === 'naiveproxy') {
+            if (portGroup) portGroup.style.display = 'none';
+            portInput.value = '443';
+            portInput.disabled = false;
+            if (naiveproxyOpts) naiveproxyOpts.style.display = 'block';
+            const npDomain = document.getElementById('installNaiveproxyDomain');
+            const npEmail = document.getElementById('installNaiveproxyEmail');
+            if (npDomain && !npDomain.value && SERVER_SSL_DOMAIN) npDomain.value = SERVER_SSL_DOMAIN;
+            if (npEmail && !npEmail.value && SERVER_SSL_EMAIL) npEmail.value = SERVER_SSL_EMAIL;
+            updateNaiveproxyDnsHint();
         } else {
             portLabel.textContent = _('port') + ' (UDP)';
             portInput.value = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 55424) : '55424';
@@ -1995,6 +2229,17 @@
             } else if (protoBase(currentInstallProto) === 'nginx') {
                 params.nginx_domain = document.getElementById('installNginxDomain').value.trim();
                 params.nginx_email = document.getElementById('installNginxEmail').value.trim();
+            } else if (protoBase(currentInstallProto) === 'hysteria') {
+                const hyPortEl = document.getElementById('installHysteriaPort');
+                if (hyPortEl && hyPortEl.value) {
+                    params.port = hyPortEl.value;
+                }
+                params.hysteria_domain = document.getElementById('installHysteriaDomain').value.trim();
+                params.hysteria_email = document.getElementById('installHysteriaEmail').value.trim();
+            } else if (protoBase(currentInstallProto) === 'naiveproxy') {
+                params.port = '443';
+                params.naiveproxy_domain = document.getElementById('installNaiveproxyDomain').value.trim();
+                params.naiveproxy_email = document.getElementById('installNaiveproxyEmail').value.trim();
             }
             const result = await apiCall(`/api/servers/${SERVER_ID}/install`, 'POST', params);
             clearInterval(progressInterval);
@@ -2210,6 +2455,107 @@
         }
     }
 
+    // ========== Hysteria Settings (port) ==========
+    async function applyHysteriaPort(proto, portValue) {
+        const port = parseInt(portValue, 10);
+        if (!port || port < 1 || port > 65535) {
+            showToast(_('error') + ': invalid port', 'error');
+            return;
+        }
+        if (port === 80) {
+            showToast(_('error') + ': port 80 reserved', 'error');
+            return;
+        }
+        try {
+            showToast(_('saving') || 'Saving...', 'info');
+            const res = await apiCall(`/api/servers/${SERVER_ID}/hysteria/settings`, 'POST', {
+                protocol: proto || 'hysteria', port,
+            });
+            showToast(res.message || _('hysteria_settings_saved'), 'success');
+            setTimeout(() => checkServer(), 800);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+            openHysteriaSettings(proto);
+        }
+    }
+
+    async function openHysteriaSettings(proto = 'hysteria') {
+        const live = currentProtocolStatus[proto] || {};
+        const livePort = live.port || 443;
+        const suggest = (parseInt(livePort, 10) === 443) ? 8998 : (livePort || 8998);
+        document.getElementById('hysteriaSetProto').value = proto;
+        document.getElementById('hysteriaSettingsTitle').textContent =
+            `${_('hysteria_settings_title')} — ${getProtoTitle(proto)}`;
+        document.getElementById('hysteriaSetDomain').value = live.domain || SERVER_SSL_DOMAIN || '';
+        document.getElementById('hysteriaSetEmail').value = live.email || SERVER_SSL_EMAIL || '';
+        document.getElementById('hysteriaSetPort').value = suggest;
+        openModal('hysteriaSettingsModal');
+        try {
+            const data = await apiCall(`/api/servers/${SERVER_ID}/hysteria/settings?protocol=${encodeURIComponent(proto)}`);
+            if (data.domain) document.getElementById('hysteriaSetDomain').value = data.domain;
+            if (data.email) document.getElementById('hysteriaSetEmail').value = data.email;
+            const p = parseInt(data.port, 10);
+            if (p && p !== 443) document.getElementById('hysteriaSetPort').value = p;
+            else if (p === 443) document.getElementById('hysteriaSetPort').value = 8998;
+        } catch (_) { /* modal already open with local values */ }
+    }
+
+    async function saveHysteriaSettings(opts = {}) {
+        const btn = document.getElementById('hysteriaSaveBtn');
+        const text = document.getElementById('hysteriaSaveBtnText');
+        const spinner = document.getElementById('hysteriaSaveSpinner');
+        const renewBtn = document.getElementById('hysteriaRenewBtn');
+        const renewText = document.getElementById('hysteriaRenewBtnText');
+        const renewSpinner = document.getElementById('hysteriaRenewSpinner');
+        const proto = document.getElementById('hysteriaSetProto').value || 'hysteria';
+        const port = parseInt(document.getElementById('hysteriaSetPort').value, 10);
+        const domain = document.getElementById('hysteriaSetDomain').value.trim();
+        const email = document.getElementById('hysteriaSetEmail').value.trim();
+        const renewSsl = !!opts.renew_ssl;
+        if (!port || port < 1 || port > 65535) {
+            showToast(_('error') + ': invalid port', 'error');
+            return;
+        }
+        if (port === 80) {
+            showToast(_('error') + ': port 80 reserved', 'error');
+            return;
+        }
+        if ((renewSsl || domain) && (!domain || !email)) {
+            showToast(_('error') + ': ' + _('hysteria_ssl_required'), 'error');
+            return;
+        }
+        btn.disabled = true;
+        if (renewBtn) renewBtn.disabled = true;
+        if (renewSsl) {
+            renewText.textContent = _('saving') || 'Saving...';
+            renewSpinner.classList.remove('hidden');
+        } else {
+            text.textContent = _('saving') || 'Saving...';
+            spinner.classList.remove('hidden');
+        }
+        try {
+            const res = await apiCall(`/api/servers/${SERVER_ID}/hysteria/settings`, 'POST', {
+                protocol: proto, port, domain, email, renew_ssl: renewSsl,
+            });
+            showToast(res.message || _('hysteria_settings_saved'), 'success');
+            closeModal('hysteriaSettingsModal');
+            setTimeout(() => checkServer(), 800);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+        } finally {
+            btn.disabled = false;
+            if (renewBtn) renewBtn.disabled = false;
+            text.textContent = _('save');
+            spinner.classList.add('hidden');
+            if (renewText) renewText.textContent = _('hysteria_renew_ssl');
+            if (renewSpinner) renewSpinner.classList.add('hidden');
+        }
+    }
+
+    async function renewHysteriaSsl() {
+        return saveHysteriaSettings({ renew_ssl: true });
+    }
+
     // ========== SOCKS5 Settings ==========
     async function openSocks5Settings(proto = 'socks5') {
         currentSocks5Proto = proto || 'socks5';
@@ -2294,7 +2640,7 @@
                 const sent = userData.dataSent || '';
                 const initial = name.charAt(0).toUpperCase();
                 const enabled = (client.enabled !== undefined) ? client.enabled : (userData.enabled !== false);
-                const hasPrivKey = !!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt';
+                const hasPrivKey = !!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt' || protoBase(proto) === 'hysteria' || protoBase(proto) === 'naiveproxy';
                 const assignedUser = client.assigned_user || '';
 
                 let metaHtml = '';
@@ -2332,7 +2678,7 @@
                             </div>
                         </div>
                         <div class="client-actions">
-                            <button class="btn btn-secondary btn-sm btn-icon" onclick="showConnectionConfig('${escapeJs(client.clientId)}', '${escapeJs(name)}', ${!!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt'})" title="${_('config')}">${uiIcon('file')}</button>
+                            <button class="btn btn-secondary btn-sm btn-icon" onclick="showConnectionConfig('${escapeJs(client.clientId)}', '${escapeJs(name)}', ${!!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt' || protoBase(proto) === 'hysteria' || protoBase(proto) === 'naiveproxy'})" title="${_('config')}">${uiIcon('file')}</button>
                             ${proto === 'telemt' ? `<button class="btn btn-secondary btn-sm btn-icon" onclick="editConnection('${escapeJs(client.clientId)}')" title="${_('edit')}">${uiIcon('pencil')}</button>` : ''}
                             <button class="btn btn-secondary btn-sm btn-icon" onclick="toggleConnection('${escapeJs(client.clientId)}', ${!enabled})" title="${toggleTitle}">${toggleIcon}</button>
                             <button class="btn btn-danger btn-sm btn-icon" onclick="removeConnection('${escapeJs(client.clientId)}')" title="${_('delete')}">${uiIcon('trash')}</button>
@@ -2384,8 +2730,8 @@
                     document.getElementById('configModalTitle').textContent = `${_('config')} — ${connName}`;
                     document.getElementById('configText').textContent = result.config;
                     document.getElementById('vpnLinkText').textContent = currentVpnLink;
-                    document.getElementById('panel-vpn').style.display = (proto === 'telemt' ? 'none' : '');
-                    document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' ? 'none' : '');
+                    document.getElementById('panel-vpn').style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' || protoBase(proto) === 'naiveproxy' ? 'none' : '');
+                    document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' || protoBase(proto) === 'naiveproxy' ? 'none' : '');
                     switchConfigTab('conf');
                     openModal('configModal');
                     generateQR(result.config);
@@ -2463,9 +2809,9 @@
         const proto = document.getElementById('connProtoSelect').value;
 
         // Restore tabs visibility first
-        document.getElementById('panel-vpn').style.display = (proto === 'telemt' ? 'none' : '');
+        document.getElementById('panel-vpn').style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' || protoBase(proto) === 'naiveproxy' ? 'none' : '');
         document.getElementById('panel-qr').style.display = '';
-        document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' ? 'none' : '');
+        document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' || protoBase(proto) === 'naiveproxy' ? 'none' : '');
         document.querySelectorAll('.config-tab')[2].style.display = '';
 
         // Client was created via native Amnezia app — private key is not stored server-side
@@ -2497,6 +2843,16 @@
                 document.getElementById('configModalTitle').textContent = `${_('config')} — ${connName}`;
                 document.getElementById('configText').textContent = result.config;
                 document.getElementById('vpnLinkText').textContent = currentVpnLink;
+                const hintEl = document.getElementById('configClientHint');
+                if (hintEl) {
+                    if (protoBase(proto) === 'naiveproxy') {
+                        hintEl.textContent = _('naiveproxy_client_hint');
+                        hintEl.classList.remove('hidden');
+                    } else {
+                        hintEl.textContent = '';
+                        hintEl.classList.add('hidden');
+                    }
+                }
                 switchConfigTab('conf');
                 openModal('configModal');
                 generateQR(result.config);
@@ -2609,6 +2965,7 @@
     }
 
 
+
     // ========== Init ==========
     applyInstalledAppsVisibility();
     checkServer();

templates/settings.html

@@ -110,21 +110,26 @@
                     <div id="guestCreateFields"
                         style="{% if not settings.guest.allow_create %}display:none;{% endif %} background: var(--bg-primary); padding: var(--space-md); border-radius: var(--radius-md);">
                         <div class="form-group">
-                            <label class="form-label">{{ _('protocol_label') }}</label>
-                            <select class="form-select" id="guest_create_protocol" onchange="updateGuestCreateFields()">
-                                <option value="xui" {% if settings.guest.create_protocol == 'xui' %}selected{% endif %}>3x-ui VLESS</option>
-                                {% for s in servers %}
-                                {% set server_idx = loop.index0 %}
-                                {% for key, info in (s.protocols or {}).items() %}
-                                {% if info.installed and key.split('__')[0] in ['awg','awg2','awg_legacy','xray','wireguard','telemt'] %}
-                                <option value="{{ key }}|{{ server_idx }}"
-                                    {% if settings.guest.create_protocol == key and settings.guest.create_server_id == server_idx %}selected{% endif %}>
-                                    {{ s.name or s.host }} — {{ key }}
-                                </option>
+                            <label class="form-label">{{ _('server_label') }}</label>
+                            <select class="form-select" id="guest_create_server" onchange="fillGuestProtocols()">
+                                {% if xui_servers %}
+                                <option value="xui" {% if settings.guest.create_protocol == 'xui' %}selected{% endif %}>3x-ui</option>
                                 {% endif %}
-                                {% endfor %}
+                                {% for s in servers %}
+                                <option value="{{ loop.index0 }}"
+                                    {% if settings.guest.create_protocol != 'xui' and settings.guest.create_server_id == loop.index0 %}selected{% endif %}>
+                                    {{ s.name or s.host }} ({{ s.host }})
+                                </option>
                                 {% endfor %}
                             </select>
+                            <div class="form-hint">{{ _('server_then_protocol_hint') }}</div>
+                        </div>
+                        <div class="form-group">
+                            <label class="form-label">{{ _('protocol_label') }}</label>
+                            <select class="form-select" id="guest_create_protocol" onchange="updateGuestCreateFields()">
+                                <!-- filled by JS -->
+                            </select>
+                            <input type="hidden" id="guest_create_protocol_pref" value="{{ settings.guest.create_protocol or '' }}">
                         </div>
                         <div class="form-group" id="guestInboundGroup" style="{% if settings.guest.create_protocol != 'xui' %}display:none;{% endif %}">
                             <label class="form-label">{{ _('xui_server_select_label') }}</label>
@@ -592,15 +597,20 @@
                     <!-- Updated via JS -->
                 </div>
 
-                <div style="display: flex; gap: var(--space-sm); margin-top: var(--space-sm);">
-                    <button type="button" class="btn btn-secondary" onclick="checkForUpdates()" id="checkUpdateBtn" style="flex:1;">
+                <div style="display: flex; gap: var(--space-sm); margin-top: var(--space-sm); flex-wrap: wrap;">
+                    <button type="button" class="btn btn-secondary" onclick="checkForUpdates()" id="checkUpdateBtn" style="flex:1; min-width:140px;">
                         <span id="checkUpdateBtnText">🔄 {{ _('check_updates') }}</span>
                         <div class="spinner hidden" id="checkUpdateSpinner" style="width:14px; height:14px;"></div>
                     </button>
-                    <a href="https://github.com/PRVTPRO/Amnezia-Web-Panel/releases" target="_blank" class="btn btn-primary hidden" id="downloadUpdateBtn" style="flex:1; text-decoration: none; justify-content: center;">
+                    <button type="button" class="btn btn-primary hidden" onclick="applyPanelUpdate()" id="applyUpdateBtn" style="flex:1; min-width:140px;">
+                        <span id="applyUpdateBtnText">⬆ {{ _('apply_update') }}</span>
+                        <div class="spinner hidden" id="applyUpdateSpinner" style="width:14px; height:14px;"></div>
+                    </button>
+                    <a href="https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases" target="_blank" class="btn btn-secondary hidden" id="downloadUpdateBtn" style="flex:1; min-width:140px; text-decoration: none; justify-content: center;">
                         ⬇️ {{ _('download_update') }}
                     </a>
                 </div>
+                <p class="form-hint" id="updateModeHint" style="margin:0;">{{ _('auto_update_hint') }}</p>
             </div>
         </div>
     </div>
@@ -1275,13 +1285,14 @@
 
         let createProtocol = 'xui';
         let createServerId = 0;
-        const guestProtoRaw = document.getElementById('guest_create_protocol').value;
-        if (guestProtoRaw === 'xui') {
+        const guestServerVal = document.getElementById('guest_create_server')?.value || 'xui';
+        const guestProtoVal = document.getElementById('guest_create_protocol')?.value || '';
+        if (guestServerVal === 'xui' || guestProtoVal === 'xui') {
             createProtocol = 'xui';
-        } else if (guestProtoRaw.includes('|')) {
-            const parts = guestProtoRaw.split('|');
-            createProtocol = parts[0];
-            createServerId = parseInt(parts[1] || '0');
+            createServerId = 0;
+        } else {
+            createProtocol = guestProtoVal;
+            createServerId = parseInt(guestServerVal || '0', 10) || 0;
         }
 
         const guest = {
@@ -1314,6 +1325,70 @@
         }
     }
 
+    const guestServersData = {{ servers | default([]) | tojson }};
+    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy'];
+    const PROTO_TITLES = {
+        awg2: 'AmneziaWG 2.0',
+        awg: 'AmneziaWG',
+        awg_legacy: 'AWG Legacy',
+        wireguard: 'WireGuard',
+        xray: 'Xray (VLESS-Reality)',
+        telemt: 'Telemt',
+        hysteria: 'Hysteria 2',
+        naiveproxy: 'NaiveProxy',
+        xui: '3x-ui VLESS',
+    };
+    function protoTitle(key) {
+        const raw = String(key || '');
+        const base = raw.split('__')[0];
+        const title = PROTO_TITLES[base] || base.toUpperCase();
+        const m = raw.match(/__(\d+)$/);
+        return m ? `${title} #${m[1]}` : title;
+    }
+
+    function fillGuestProtocols() {
+        const serverSel = document.getElementById('guest_create_server');
+        const protoSel = document.getElementById('guest_create_protocol');
+        if (!serverSel || !protoSel) return;
+        const prefer = document.getElementById('guest_create_protocol_pref')?.value || protoSel.value || '';
+        const serverVal = serverSel.value;
+        protoSel.innerHTML = '';
+        if (serverVal === 'xui') {
+            const opt = document.createElement('option');
+            opt.value = 'xui';
+            opt.textContent = PROTO_TITLES.xui;
+            protoSel.appendChild(opt);
+            updateGuestCreateFields();
+            return;
+        }
+        const server = guestServersData[parseInt(serverVal, 10)];
+        const protocols = (server && server.protocols) || {};
+        const installed = Object.keys(protocols).filter(k => {
+            const info = protocols[k] || {};
+            return !!info.installed && VPN_PROTO_ORDER.includes(k.split('__')[0]);
+        }).sort((a, b) => {
+            const ia = VPN_PROTO_ORDER.indexOf(a.split('__')[0]);
+            const ib = VPN_PROTO_ORDER.indexOf(b.split('__')[0]);
+            return (ia < 0 ? 99 : ia) - (ib < 0 ? 99 : ib) || a.localeCompare(b);
+        });
+        if (!installed.length) {
+            const opt = document.createElement('option');
+            opt.value = '';
+            opt.disabled = true;
+            opt.textContent = _('no_protocols');
+            protoSel.appendChild(opt);
+        } else {
+            installed.forEach(key => {
+                const opt = document.createElement('option');
+                opt.value = key;
+                opt.textContent = protoTitle(key);
+                if (prefer && prefer === key) opt.selected = true;
+                protoSel.appendChild(opt);
+            });
+        }
+        updateGuestCreateFields();
+    }
+
     function updateGuestCreateFields() {
         const v = document.getElementById('guest_create_protocol')?.value;
         const group = document.getElementById('guestInboundGroup');
@@ -1321,6 +1396,7 @@
         if (v === 'xui') loadGuestInbounds();
     }
 
+    fillGuestProtocols();
     if (document.getElementById('guest_create_protocol')?.value === 'xui') {
         loadGuestInbounds();
     }
@@ -1411,46 +1487,98 @@
         updateProtocolsForSync();
     }
 
-    async function checkForUpdates() {
+    let latestUpdateInfo = null;
+
+    async function checkForUpdates(silent) {
         const btn = document.getElementById('checkUpdateBtn');
         const text = document.getElementById('checkUpdateBtnText');
         const spinner = document.getElementById('checkUpdateSpinner');
         const statusDiv = document.getElementById('updateStatus');
         const downloadBtn = document.getElementById('downloadUpdateBtn');
+        const applyBtn = document.getElementById('applyUpdateBtn');
+        const modeHint = document.getElementById('updateModeHint');
 
+        if (!silent) {
             btn.disabled = true;
             text.textContent = "{{ _('checking_updates')|default('Checking...') }}";
             spinner.classList.remove('hidden');
+        }
         statusDiv.classList.add('hidden');
         downloadBtn.classList.add('hidden');
+        applyBtn.classList.add('hidden');
 
         try {
-            const response = await fetch('https://api.github.com/repos/PRVTPRO/Amnezia-Web-Panel/releases/latest');
-            if (!response.ok) throw new Error('API Error');
-            const data = await response.json();
-            
-            const latestVersion = data.tag_name;
-            const currentVersion = '{{ current_version }}';
-            
+            const data = await apiCall('/api/settings/check_updates');
+            latestUpdateInfo = data;
+            const latestVersion = data.latest_version || '';
             statusDiv.classList.remove('hidden');
 
-            if (latestVersion !== currentVersion && latestVersion) {
+            if (modeHint) {
+                const mode = data.update_mode || (data.mode && data.mode.mode) || '';
+                if (data.can_auto_update) {
+                    modeHint.textContent = "{{ _('auto_update_ready')|default('Git auto-update is available for this install.') }}";
+                } else if (mode === 'docker') {
+                    modeHint.textContent = "{{ _('auto_update_docker')|default('Docker install: rebuild/pull image, or use a git checkout for one-click update.') }}";
+                } else {
+                    modeHint.textContent = "{{ _('auto_update_manual')|default('One-click update needs a git clone. You can still download a release.') }}";
+                }
+            }
+
+            if (data.update_available && latestVersion) {
                 statusDiv.innerHTML = `<span style="color: var(--success); font-weight: bold;">{{ _('update_available')|default('Update available') }}: ${latestVersion}</span>`;
                 statusDiv.style.border = '1px solid var(--success)';
-                downloadBtn.href = data.html_url;
+                downloadBtn.href = data.html_url || data.releases_url || 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases';
                 downloadBtn.classList.remove('hidden');
+                if (data.can_auto_update) {
+                    applyBtn.classList.remove('hidden');
+                }
             } else {
                 statusDiv.innerHTML = `<span style="color: var(--text-muted);">{{ _('up_to_date')|default('Up to date') }}</span>`;
                 statusDiv.style.border = '1px solid var(--border-color)';
             }
         } catch (err) {
-            showToast('Failed to check for updates: ' + err.message, 'error');
+            if (!silent) showToast('Failed to check for updates: ' + err.message, 'error');
         } finally {
+            if (!silent) {
                 btn.disabled = false;
                 text.textContent = "🔄 {{ _('check_updates')|default('Check for updates') }}";
                 spinner.classList.add('hidden');
             }
         }
+    }
+
+    async function applyPanelUpdate() {
+        const applyBtn = document.getElementById('applyUpdateBtn');
+        const applyText = document.getElementById('applyUpdateBtnText');
+        const applySpinner = document.getElementById('applyUpdateSpinner');
+        const target = (latestUpdateInfo && latestUpdateInfo.latest_version) || '';
+        if (!target) {
+            showToast("{{ _('update_no_target')|default('No target version. Check for updates first.') }}", 'error');
+            return;
+        }
+        if (!confirm("{{ _('apply_update_confirm')|default('Install update from git and restart the panel?') }} " + target)) {
+            return;
+        }
+        applyBtn.disabled = true;
+        applyText.textContent = "{{ _('applying_update')|default('Updating…') }}";
+        applySpinner.classList.remove('hidden');
+        try {
+            const data = await apiCall('/api/settings/apply_update', 'POST', {
+                target_version: target,
+                allow_dirty: false,
+            });
+            showToast(data.message || "{{ _('update_restarting')|default('Updated. Restarting…') }}", 'success');
+            setTimeout(() => { window.location.reload(); }, 3500);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+            applyBtn.disabled = false;
+            applyText.textContent = "⬆ {{ _('apply_update')|default('Install update') }}";
+            applySpinner.classList.add('hidden');
+        }
+    }
+
+    // Auto-check once on Settings load
+    setTimeout(() => checkForUpdates(true), 800);
 
     /* ========== API Tokens ========== */
 

templates/users.html

@@ -143,9 +143,10 @@
                 <select class="form-select" id="newUserServer">
                     <option value="">{{ _('no_create_conn') }}</option>
                     {% for s in servers %}
-                    <option value="{{ loop.index0 }}">{{ s.name }} ({{ s.host }})</option>
+                    <option value="{{ loop.index0 }}">{{ s.name or s.host }} ({{ s.host }})</option>
                     {% endfor %}
                 </select>
+                <div class="form-hint">{{ _('server_then_protocol_hint') }}</div>
             </div>
 
             <div class="form-group" id="newUserProtoGroup" style="display:none;">
@@ -293,10 +294,14 @@
         <div class="form-group" id="ucServerGroup">
             <label class="form-label">{{ _('server_label') }}</label>
             <select class="form-select" id="ucServer">
+                {% if xui_servers %}
+                <option value="xui">3x-ui</option>
+                {% endif %}
                 {% for s in servers %}
-                <option value="{{ loop.index0 }}">{{ s.name }} ({{ s.host }})</option>
+                <option value="{{ loop.index0 }}">{{ s.name or s.host }} ({{ s.host }})</option>
                 {% endfor %}
             </select>
+            <div class="form-hint">{{ _('server_then_protocol_hint') }}</div>
         </div>
 
         <div class="form-group" id="ucProtoGroup">
@@ -626,30 +631,57 @@
         const select = document.getElementById(selectId);
         const group = groupId ? document.getElementById(groupId) : null;
         select.innerHTML = '';
-        const vpnBases = new Set(['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard']);
+        const vpnOrder = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy'];
+        const titles = {
+            awg2: 'AmneziaWG 2.0',
+            awg: 'AmneziaWG',
+            awg_legacy: 'AWG Legacy',
+            wireguard: 'WireGuard',
+            xray: 'Xray (VLESS-Reality)',
+            telemt: 'Telemt',
+            hysteria: 'Hysteria 2',
+            naiveproxy: 'NaiveProxy',
+            xui: '3x-ui VLESS',
+        };
+        const protoTitle = (key) => {
+            const base = String(key || '').split('__')[0];
+            const title = titles[base] || base.toUpperCase();
+            const m = String(key || '').match(/__(\d+)$/);
+            return m ? `${title} #${m[1]}` : title;
+        };
         let count = 0;
 
+        // Special source: 3x-ui (server picker value "xui")
+        if (String(serverId) === 'xui') {
+            const opt = document.createElement('option');
+            opt.value = 'xui';
+            opt.textContent = titles.xui;
+            select.appendChild(opt);
+            count = 1;
+            if (group) group.style.display = '';
+            if (selectId === 'ucProtocol') updateXuiInboundVisibility();
+            return;
+        }
+
         const server = (serverId !== '' && serversData[serverId]) ? serversData[serverId] : null;
         const protocols = (server && server.protocols) || {};
+        const installed = Object.keys(protocols).filter(key => {
+            const info = protocols[key] || {};
+            if (!info.installed) return false;
+            return vpnOrder.includes(key.split('__')[0]);
+        }).sort((a, b) => {
+            const ia = vpnOrder.indexOf(a.split('__')[0]);
+            const ib = vpnOrder.indexOf(b.split('__')[0]);
+            return (ia < 0 ? 99 : ia) - (ib < 0 ? 99 : ib) || a.localeCompare(b);
+        });
 
-        for (const [key, info] of Object.entries(protocols)) {
-            if (!info.installed) continue;
-            const base = key.split('__')[0];
-            if (!vpnBases.has(base)) continue;
+        installed.forEach(key => {
             const opt = document.createElement('option');
             opt.value = key;
-            opt.textContent = key === 'awg' ? 'AmneziaWG' : (key === 'awg2' ? 'AmneziaWG 2.0' : (key === 'awg_legacy' ? 'AWG Legacy' : (key === 'xray' ? 'Xray' : (key === 'wireguard' ? 'WireGuard' : (key === 'telemt' ? 'Telemt' : key.toUpperCase())))));
+            opt.textContent = protoTitle(key);
             select.appendChild(opt);
             count++;
-        }
-
-        if (xuiConfigured && selectId === 'ucProtocol') {
-            const opt = document.createElement('option');
-            opt.value = 'xui';
-            opt.textContent = '3x-ui VLESS';
-            select.appendChild(opt);
-            count++;
-        }
+        });
 
         if (count > 0) {
             if (group) group.style.display = '';
@@ -724,9 +756,12 @@
 
     document.getElementById('ucServer').addEventListener('change', (e) => {
         updateProtocols(e.target.value, 'ucProtocol');
-        if (document.getElementById('ucMode').value === 'existing') {
+        const mode = document.getElementById('ucMode').value;
+        if (mode === 'existing' && e.target.value !== 'xui') {
             fetchExistingClients();
         }
+        updateTelemtOptions('ucProtocol', 'ucTelemtOptions');
+        updateXuiInboundVisibility();
     });
 
     document.getElementById('ucProtocol').addEventListener('change', (e) => {
@@ -898,13 +933,18 @@
         spinner.classList.remove('hidden');
 
         try {
+            const serverRaw = document.getElementById('ucServer').value;
+            const protocol = document.getElementById('ucProtocol').value;
             const body = {
-                server_id: parseInt(document.getElementById('ucServer').value) || 0,
-                protocol: document.getElementById('ucProtocol').value,
+                server_id: serverRaw === 'xui' ? 0 : (parseInt(serverRaw, 10) || 0),
+                protocol: protocol,
                 name: document.getElementById('ucName').value || 'VPN Connection',
             };
 
             if (mode === 'existing') {
+                if (serverRaw === 'xui' || protocol === 'xui') {
+                    throw new Error(_('link_existing_xui_unsupported') || 'Link existing is only for Amnezia server protocols');
+                }
                 const clientId = document.getElementById('ucExistingClient').value;
                 if (!clientId) throw new Error(_('select_connection'));
                 body.client_id = clientId;

translations/en.json

@@ -39,7 +39,7 @@
     "limit":  "Limit",
     "manage":  "Manage",
     "no_protocols":  "No protocols",
-  "add_server_desc": "Add your first VPN server to get started. You'll need SSH credentials to connect.",
+    "add_server_desc":  "Add your first VPN server to get started. You\u0027ll need SSH credentials to connect.",
     "ssh_host":  "Host / IP",
     "ssh_port":  "SSH Port",
     "ssh_user":  "User",
@@ -80,8 +80,8 @@
     "no_connections":  "No connections",
     "no_connections_desc":  "Add your first connection to generate a VPN configuration",
     "install_protocol":  "Install protocol",
-  "port_default_hint": "Default port: 55424. Make sure it's not busy",
-  "port_xray_hint": "Default port: 443 (recommended for Xray). Make sure it's not taken by another web server.",
+    "port_default_hint":  "Default port: 55424. Make sure it\u0027s not busy",
+    "port_xray_hint":  "Default port: 443 (recommended for Xray). Make sure it\u0027s not taken by another web server.",
     "reinstall":  "Reinstall",
     "uninstall_confirm":  "Uninstall {}? All connections and configurations will be lost.",
     "stop_container_confirm":  "Stop container {}?",
@@ -153,6 +153,7 @@
     "server_label":  "Server",
     "no_create_conn":  "— Do not create connection —",
     "protocol_label":  "Protocol",
+    "server_then_protocol_hint":  "Choose a server first, then a protocol installed on it (WireGuard, AmneziaWG 2.0, etc.).",
     "edit_user_title":  "Edit user: {}",
     "edit_user_tg":  "Telegram ID (optional)",
     "edit_user_email":  "Email (optional)",
@@ -264,10 +265,10 @@
     "bot_start_btn":  "▶️ Start",
     "bot_hint":  "After changing the token, save the settings — the bot will restart automatically. Users must have a Telegram ID in their profile.",
     "api_docs_title":  "🔌 API Documentation",
-  "api_docs_hint": "Use these interfaces to explore the panel's API capabilities",
+    "api_docs_hint":  "Use these interfaces to explore the panel\u0027s API capabilities",
     "tunnels_title":  "Tunnels",
     "local_server":  "Local Server",
-  "tunnel_install_enable": "Install & Enable",
+    "tunnel_install_enable":  "Install \u0026 Enable",
     "tunnel_enable":  "Enable Tunnel",
     "tunnel_running":  "Tunnel running",
     "tunnel_stop":  "Stop",
@@ -316,7 +317,7 @@
     "copy_key_big":  "Copy key",
     "copying_key":  "Copying…",
     "key_copied":  "Key copied — paste it into the app",
-  "more_qr_download": "QR code & file",
+    "more_qr_download":  "QR code \u0026 file",
     "download_config_file":  "Download config file",
     "show_config_text":  "Show config text",
     "copied":  "Copied!",
@@ -346,9 +347,34 @@
     "restore_success":  "Restore successful! Restarting...",
     "invalid_backup_file":  "Invalid backup file or structure",
     "config_unavailable":  "Configuration unavailable",
-  "config_unavailable_desc": "This client was created via the native Amnezia app.\\nThe private key is stored only on the user's device and cannot be recovered by the server.",
+    "config_unavailable_desc":  "This client was created via the native Amnezia app.\\nThe private key is stored only on the user\u0027s device and cannot be recovered by the server.",
     "client_public_key":  "Client public key:",
     "telemt_desc":  "MTProxy-based Telegram proxy with advanced obfuscation and TLS emulation support.",
+    "hysteria_desc":  "Hysteria 2 (QUIC/UDP) via official tobyxdd/hysteria (apernet/hysteria) with Let\u0027s Encrypt TLS. Admin sets the domain at install time.",
+    "hysteria_domain":  "Domain",
+    "hysteria_email":  "Let\u0027s Encrypt email",
+    "hysteria_port_hint":  "UDP port for Hysteria (default 8998). Avoid 443 if nginx/xray already use UDP/TCP 443. Port 80/TCP must be free for certificate issuance.",
+    "hysteria_install_hint":  "Point the domain A-record to this server before install. Port 80/TCP is used temporarily for Let\u0027s Encrypt HTTP-01 validation. BBR and salamander obfuscation are enabled automatically.",
+    "hysteria_dns_hint":  "Create this DNS record before installation:",
+    "hysteria_settings_title":  "Hysteria settings",
+    "hysteria_change_port":  "Change port",
+    "hysteria_port_change_hint":  "UDP listen port. If you see “address already in use”, pick a free port (e.g. 8443 or 8998), save, then re-import the client link.",
+    "hysteria_settings_saved":  "Hysteria settings updated",
+    "hysteria_ports_warning":  "Warning: free TCP ports 80 and 443 are required for stable operation (Let\u0027s Encrypt on 80, HTTPS/QUIC on 443).",
+    "hysteria_renew_ssl":  "Renew SSL",
+    "hysteria_ssl_change_hint":  "Changing the domain re-issues the Let\u0027s Encrypt certificate (port 80 must be free).",
+    "hysteria_ssl_required":  "Domain and email are required for SSL",
+    "naiveproxy_desc":  "NaiveProxy (stable) — HTTPS/HTTP2 via Caddy + forwardproxy, Let\u0027s Encrypt TLS. Client: use Karing. Do not use v2rayN; other clients untested.",
+    "naiveproxy_domain":  "Domain",
+    "naiveproxy_email":  "Let\u0027s Encrypt email",
+    "naiveproxy_port_hint":  "TCP port 443 is fixed for NaiveProxy. Port 80/TCP must be free for certificate issuance.",
+    "naiveproxy_install_hint":  "Point the domain A-record to this server before install. Free TCP ports 80 and 443 are required (Let\u0027s Encrypt and HTTPS proxy).",
+    "naiveproxy_dns_hint":  "Create this DNS record before installation:",
+    "naiveproxy_ports_warning":  "Warning: free TCP ports 80 and 443 are required for stable operation (Let\u0027s Encrypt on 80, HTTPS proxy on 443).",
+    "naiveproxy_client_hint":  "Stable build. Do NOT use v2rayN. Confirmed working in Karing. Other clients are untested.",
+    "server_ssl_domain":  "SSL domain (default)",
+    "server_ssl_email":  "SSL email (default)",
+    "server_ssl_hint":  "Used when installing Hysteria / NGINX on this server (Let\u0027s Encrypt).",
     "container_logs":  "Container logs",
     "logs_btn":  "📋 Logs",
     "logs_live":  "Live",
@@ -407,7 +433,7 @@
     "ping_checking":  "Checking connectivity...",
     "offline":  "offline",
     "api_tokens_title":  "API tokens",
-  "api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
+    "api_tokens_hint":  "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer \u003ctoken\u003e` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
     "api_tokens_empty":  "No API tokens yet. Create one to integrate the panel with an external service.",
     "api_tokens_create":  "Create token",
     "api_tokens_create_title":  "Create API token",
@@ -417,8 +443,8 @@
     "api_tokens_name_required":  "Token name is required",
     "api_tokens_created_title":  "Token created",
     "api_tokens_value_label":  "Token value",
-  "api_tokens_warning_title": "This is the only time you'll see this token.",
-  "api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
+    "api_tokens_warning_title":  "This is the only time you\u0027ll see this token.",
+    "api_tokens_warning_body":  "Copy it now and store it in your integration\u0027s secret manager. The panel keeps only a hash — if you lose this value you\u0027ll need to revoke and recreate the token.",
     "api_tokens_revoke":  "Revoke",
     "api_tokens_revoke_confirm":  "Revoke token \"{}\"? Any integration using it will stop working.",
     "api_tokens_revoked":  "Token revoked",
@@ -448,13 +474,22 @@
     "cert_text_label":  "Certificate content (CRT)",
     "key_text_label":  "Private Key content (KEY)",
     "ssl_hint":  "After enabling, the panel will be accessible via https:// on the specified domain. Make sure the file paths or text data are correct.",
-  "about_title": "About & Updates",
+    "about_title":  "About \u0026 Updates",
     "current_version":  "Current version",
     "check_updates":  "Check for updates",
     "checking_updates":  "Checking...",
     "update_available":  "New version available",
     "download_update":  "Download update",
     "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release.",
     "warp_hint":  "WARP routes this host outbound through Cloudflare. It does not create a public panel URL like Quick Tunnel or ngrok.",
     "warp_install_hint":  "Install the official Cloudflare WARP client first, then restart the panel.",
     "warp_install_required":  "Install WARP first",
@@ -493,10 +528,10 @@
     "port_next_instance_hint":  "Choose a free UDP port for the additional instance.",
     "checking_server":  "Checking server services...",
     "web_servers":  "Web servers",
-  "nginx_desc": "NGINX web server with Let's Encrypt HTTPS certificate and editable index.html.",
+    "nginx_desc":  "NGINX web server with Let\u0027s Encrypt HTTPS certificate and editable index.html.",
     "nginx_domain":  "Domain",
-  "nginx_email": "Let's Encrypt email",
-  "nginx_port_hint": "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let's Encrypt validation.",
+    "nginx_email":  "Let\u0027s Encrypt email",
+    "nginx_port_hint":  "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let\u0027s Encrypt validation.",
     "nginx_install_hint":  "The domain must already point to this server. Port 80/TCP is used temporarily/permanently for HTTP-01 certificate validation.",
     "site":  "Site",
     "site_editor":  "Site editor",

translations/fa.json

@@ -340,6 +340,31 @@
     "clear_server":  "پاک‌سازی سرور",
     "remove_server":  "حذف سرور از پنل",
     "telemt_desc":  "پروکسی تلگرام بر پایه‌ی MTProxy با پوشش‌های پیشرفته.",
+    "hysteria_desc":  "Hysteria 2 (QUIC/UDP) با تصویر رسمی tobyxdd/hysteria (apernet/hysteria) و TLS از Let\u0027s Encrypt. دامنه را ادمین هنگام نصب مشخص می‌کند.",
+    "hysteria_domain":  "دامنه",
+    "hysteria_email":  "ایمیل Let\u0027s Encrypt",
+    "hysteria_port_hint":  "پورت UDP برای Hysteria (پیش‌فرض 8998). اگر 443 اشغال است پورت دیگری بگذارید.",
+    "hysteria_install_hint":  "قبل از نصب، رکورد A دامنه باید به این سرور اشاره کند. BBR و obfuscation salamander به‌صورت خودکار فعال می‌شوند.",
+    "hysteria_dns_hint":  "قبل از نصب این رکورد DNS را بسازید:",
+    "hysteria_settings_title":  "تنظیمات Hysteria",
+    "hysteria_change_port":  "تغییر پورت",
+    "hysteria_port_change_hint":  "پورت UDP. اگر address already in use دیدید، پورت آزاد بگذارید (8443 یا 8998).",
+    "hysteria_settings_saved":  "پورت Hysteria به‌روز شد",
+    "hysteria_ports_warning":  "هشدار: برای کار پایدار پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let\u0027s Encrypt روی ۸۰، HTTPS/QUIC روی ۴۴۳).",
+    "hysteria_renew_ssl":  "تمدید SSL",
+    "hysteria_ssl_change_hint":  "تغییر دامنه گواهی Let\u0027s Encrypt را دوباره صادر می‌کند (پورت ۸۰ باید آزاد باشد).",
+    "hysteria_ssl_required":  "برای SSL دامنه و ایمیل لازم است",
+    "naiveproxy_desc":  "NaiveProxy (پایدار) — HTTPS/HTTP2 با Caddy + forwardproxy و TLS از Let\u0027s Encrypt. کلاینت: Karing. از v2rayN استفاده نکنید؛ بقیه آزمایش نشده‌اند.",
+    "naiveproxy_domain":  "دامنه",
+    "naiveproxy_email":  "ایمیل Let\u0027s Encrypt",
+    "naiveproxy_port_hint":  "پورت TCP 443 برای NaiveProxy ثابت است. پورت 80/TCP باید برای صدور گواهی آزاد باشد.",
+    "naiveproxy_install_hint":  "قبل از نصب، رکورد A دامنه باید به این سرور اشاره کند. پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let\u0027s Encrypt و پروکسی HTTPS).",
+    "naiveproxy_dns_hint":  "قبل از نصب این رکورد DNS را بسازید:",
+    "naiveproxy_ports_warning":  "هشدار: برای کار پایدار پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let\u0027s Encrypt روی ۸۰، پروکسی HTTPS روی ۴۴۳).",
+    "naiveproxy_client_hint":  "نسخه پایدار. از v2rayN استفاده نکنید. در Karing تأیید شده. سایر کلاینت‌ها آزمایش نشده‌اند.",
+    "server_ssl_domain":  "دامنه SSL (پیش‌فرض)",
+    "server_ssl_email":  "ایمیل SSL (پیش‌فرض)",
+    "server_ssl_hint":  "هنگام نصب Hysteria / NGINX روی این سرور استفاده می‌شود (Let\u0027s Encrypt).",
     "container_logs":  "لاگ‌های کانتینر",
     "logs_btn":  "📋 Logs",
     "logs_live":  "زنده",
@@ -384,7 +409,7 @@
     "ping_checking":  "Checking connectivity...",
     "offline":  "offline",
     "api_tokens_title":  "API tokens",
-  "api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
+    "api_tokens_hint":  "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer \u003ctoken\u003e` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
     "api_tokens_empty":  "No API tokens yet. Create one to integrate the panel with an external service.",
     "api_tokens_create":  "Create token",
     "api_tokens_create_title":  "Create API token",
@@ -394,8 +419,8 @@
     "api_tokens_name_required":  "Token name is required",
     "api_tokens_created_title":  "Token created",
     "api_tokens_value_label":  "Token value",
-  "api_tokens_warning_title": "This is the only time you'll see this token.",
-  "api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
+    "api_tokens_warning_title":  "This is the only time you\u0027ll see this token.",
+    "api_tokens_warning_body":  "Copy it now and store it in your integration\u0027s secret manager. The panel keeps only a hash — if you lose this value you\u0027ll need to revoke and recreate the token.",
     "api_tokens_revoke":  "Revoke",
     "api_tokens_revoke_confirm":  "Revoke token \"{}\"? Any integration using it will stop working.",
     "api_tokens_revoked":  "Token revoked",
@@ -445,10 +470,10 @@
     "new_instance":  "new instance",
     "port_next_instance_hint":  "Choose a free UDP port for the additional instance.",
     "web_servers":  "Web servers",
-  "nginx_desc": "NGINX web server with Let's Encrypt HTTPS certificate and editable index.html.",
+    "nginx_desc":  "NGINX web server with Let\u0027s Encrypt HTTPS certificate and editable index.html.",
     "nginx_domain":  "Domain",
-  "nginx_email": "Let's Encrypt email",
-  "nginx_port_hint": "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let's Encrypt validation.",
+    "nginx_email":  "Let\u0027s Encrypt email",
+    "nginx_port_hint":  "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let\u0027s Encrypt validation.",
     "nginx_install_hint":  "The domain must already point to this server. Port 80/TCP is used for HTTP-01 certificate validation.",
     "site":  "Site",
     "site_editor":  "Site editor",
@@ -494,4 +519,21 @@
     "xui_server_select_label":  "سرور 3x-ui",
     "xui_server_select_hint":  "پنل 3x-ui که URL اشتراک می‌دهد را انتخاب کنید.",
     "xui_server_delete_confirm":  "این سرور 3x-ui حذف شود؟"
+,
+    "about_title":  "About & Updates",
+    "current_version":  "Current version",
+    "check_updates":  "Check for updates",
+    "checking_updates":  "Checking...",
+    "update_available":  "New version available",
+    "download_update":  "Download update",
+    "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release."
 }

translations/fr.json

@@ -1,7 +1,7 @@
 {
     "nav_servers":  "Serveurs",
     "nav_users":  "Utilisateurs",
-  "nav_invites": "Liens d'invitation",
+    "nav_invites":  "Liens d\u0027invitation",
     "nav_settings":  "Paramètres",
     "nav_connections":  "Connexions",
     "nav_logout":  "Déconnexion",
@@ -56,7 +56,7 @@
     "error":  "Erreur",
     "info":  "Info",
     "login_title":  "Connexion au Panneau",
-  "username": "Nom d'utilisateur",
+    "username":  "Nom d\u0027utilisateur",
     "password":  "Mot de passe",
     "captcha":  "Captcha",
     "captcha_placeholder":  "Entrez les caractères",
@@ -79,8 +79,8 @@
     "no_connections":  "Aucune connexion",
     "no_connections_desc":  "Ajoutez votre première connexion pour générer un fichier VPN",
     "install_protocol":  "Installer le protocole",
-  "port_default_hint": "Port par défaut : 55424. Assurez-vous qu'il est libre.",
-  "port_xray_hint": "Port recommandé : 443. Assurez-vous qu'il n'est pas utilisé par un serveur web.",
+    "port_default_hint":  "Port par défaut : 55424. Assurez-vous qu\u0027il est libre.",
+    "port_xray_hint":  "Port recommandé : 443. Assurez-vous qu\u0027il n\u0027est pas utilisé par un serveur web.",
     "reinstall":  "Réinstaller",
     "uninstall_confirm":  "Désinstaller {} ? Toutes les données seront perdues.",
     "stop_container_confirm":  "Arrêter le conteneur {} ?",
@@ -93,7 +93,7 @@
     "add_connection":  "Ajouter une connexion",
     "connection_name":  "Nom de la connexion",
     "connection_name_placeholder":  "Ex: iPhone, Laptop",
-  "assign_to_user": "Assigner à l'utilisateur (optionnel)",
+    "assign_to_user":  "Assigner à l\u0027utilisateur (optionnel)",
     "no_assign":  "— Aucune assignation —",
     "create":  "Créer",
     "creating":  "Création...",
@@ -107,19 +107,19 @@
     "download_conf":  "⬇ Télécharger .conf",
     "copy_key":  "📋 Copier la clé",
     "vpn_link_hint":  "Collez ce lien dans AmneziaVPN pour une config automatique",
-  "qr_hint": "Scannez le code QR dans l'application AmneziaVPN",
+    "qr_hint":  "Scannez le code QR dans l\u0027application AmneziaVPN",
     "no_data":  "Aucune donnée",
     "start_btn":  "▶ Start",
     "stop_btn":  "⏹ Stop",
     "config_btn":  "⚙️ Config",
     "done":  "Terminé",
     "installing":  "Installation...",
-  "start_install": "Début de l'installation...",
+    "start_install":  "Début de l\u0027installation...",
     "check_docker":  "Vérification de Docker...",
-  "prepare_host": "Préparation de l'hôte...",
+    "prepare_host":  "Préparation de l\u0027hôte...",
     "build_container":  "Construction du conteneur...",
     "install_success":  "Protocole installé avec succès !",
-  "install_error": "Erreur d'installation : ",
+    "install_error":  "Erreur d\u0027installation : ",
     "qr_error":  "Échec de génération du QR code",
     "users_title":  "Utilisateurs",
     "search_placeholder":  "Recherche par nom, email ou Telegram...",
@@ -130,7 +130,7 @@
     "loading_users":  "Chargement des utilisateurs...",
     "nothing_found":  "Rien trouvé",
     "search_empty_desc":  "Essayez une autre requête ou créez un utilisateur",
-  "username_label": "Nom d'utilisateur",
+    "username_label":  "Nom d\u0027utilisateur",
     "password_label":  "Mot de passe",
     "role_label":  "Rôle",
     "role_user_desc":  "User — voit ses propres connexions",
@@ -149,7 +149,7 @@
     "edit_user_email":  "Email (optionnel)",
     "edit_user_limit":  "Limite trafic (Go) (0 = illimité)",
     "new_password_hint":  "Nouveau mot de passe (laisser vide si inchangé)",
-  "op_type_label": "Type d'opération",
+    "op_type_label":  "Type d\u0027opération",
     "create_new_conn":  "Créer nouvelle connexion",
     "link_existing_conn":  "Lier existante",
     "select_existing_conn":  "Sélectionner connexion",
@@ -164,18 +164,18 @@
     "disabling":  "Désactivation",
     "user_enabled":  "Utilisateur activé",
     "user_disabled":  "Utilisateur désactivé",
-  "delete_user_confirm": "Supprimer l'utilisateur ? Ses connexions seront supprimées.",
-  "share_access": "Partager l'accès",
-  "enable_public_access": "Activer l'accès public",
+    "delete_user_confirm":  "Supprimer l\u0027utilisateur ? Ses connexions seront supprimées.",
+    "share_access":  "Partager l\u0027accès",
+    "enable_public_access":  "Activer l\u0027accès public",
     "share_password_label":  "Mot de passe (optionnel)",
-  "share_password_hint": "Si défini, requis pour l'accès",
+    "share_password_hint":  "Si défini, requis pour l\u0027accès",
     "guest_settings_title":  "Accès invité",
-  "guest_enable": "Activer l'accès invité (sans inscription)",
-  "guest_enable_hint": "Lien public sur la page de connexion. Les invités voient les connexions de l'utilisateur choisi.",
+    "guest_enable":  "Activer l\u0027accès invité (sans inscription)",
+    "guest_enable_hint":  "Lien public sur la page de connexion. Les invités voient les connexions de l\u0027utilisateur choisi.",
     "guest_link_label":  "Lien invité",
     "guest_link_placeholder":  "Enregistrez pour générer le lien",
     "guest_regen_token":  "Régénérer le lien",
-  "guest_regen_confirm": "Régénérer le lien invité ? L'ancien ne fonctionnera plus.",
+    "guest_regen_confirm":  "Régénérer le lien invité ? L\u0027ancien ne fonctionnera plus.",
     "guest_token_updated":  "Lien invité mis à jour",
     "guest_user_label":  "Utilisateur des connexions invitées",
     "guest_user_none":  "— Choisir —",
@@ -183,7 +183,7 @@
     "guest_password_label":  "Mot de passe invité (optionnel)",
     "guest_password_keep":  "Laisser vide pour conserver",
     "guest_clear_password":  "Retirer le mot de passe",
-  "guest_allow_create": "Autoriser la création d'une config",
+    "guest_allow_create":  "Autoriser la création d\u0027une config",
     "guest_access_btn":  "Continuer en invité",
     "guest_access_login_hint":  "Sans compte",
     "guest_title":  "Accès invité",
@@ -194,15 +194,15 @@
     "guest_not_found":  "404 Introuvable",
     "guest_not_found_desc":  "Accès invité désactivé ou lien invalide.",
     "wrong_guest_password":  "Mauvais mot de passe",
-  "invites_title": "Liens d'invitation",
-  "invites_hint": "Créez des liens partageables. Le destinataire peut créer une config VPN — vous fixez le nombre d'utilisations.",
+    "invites_title":  "Liens d\u0027invitation",
+    "invites_hint":  "Créez des liens partageables. Le destinataire peut créer une config VPN — vous fixez le nombre d\u0027utilisations.",
     "invites_empty":  "Aucun lien",
     "invites_empty_desc":  "Créez un lien à partager — sans inscription.",
     "invite_create":  "Créer un lien",
     "invite_edit":  "Modifier le lien",
     "invite_active":  "Actif",
     "invite_expired":  "Expiré",
-  "invite_exhausted": "Plus d'utilisations",
+    "invite_exhausted":  "Plus d\u0027utilisations",
     "invite_uses":  "Utilisations",
     "invite_name_label":  "Nom du lien",
     "invite_max_uses_label":  "Configs max",
@@ -213,13 +213,13 @@
     "invite_password_label":  "Mot de passe (optionnel)",
     "invite_expires_label":  "Expiration (optionnel)",
     "invite_duration_label":  "Durée du config (jours)",
-  "invite_duration_hint": "Commence quand l'utilisateur clique Obtenir. 0 = illimité.",
+    "invite_duration_hint":  "Commence quand l\u0027utilisateur clique Obtenir. 0 = illimité.",
     "invite_duration_short":  "Durée",
     "invite_duration_starts_hint":  "Après obtention, valable {} jour(s)",
-  "invite_config_expires_at": "Valable jusqu'au : {}",
+    "invite_config_expires_at":  "Valable jusqu\u0027au : {}",
     "invite_sub_tab":  "Abonnement",
     "days_short":  "j",
-  "invite_clear_expires": "Retirer l'expiration",
+    "invite_clear_expires":  "Retirer l\u0027expiration",
     "invite_note_label":  "Note (admin)",
     "invite_note_placeholder":  "Commentaire interne",
     "invite_reset_used":  "Réinitialiser le compteur",
@@ -255,7 +255,7 @@
     "bot_start_btn":  "▶️ Démarrer",
     "bot_hint":  "Sauvegardez après modification du token. Le bot redémarrera.",
     "api_docs_title":  "🔌 Documentation API",
-  "api_docs_hint": "Utilisez ces interfaces pour explorer l'API",
+    "api_docs_hint":  "Utilisez ces interfaces pour explorer l\u0027API",
     "tunnels_title":  "Tunnels",
     "local_server":  "Serveur local",
     "tunnel_install_enable":  "Installer et activer",
@@ -269,8 +269,8 @@
     "tunnel_delete_confirm":  "Arrêter et supprimer ce binaire de tunnel géré par le panneau ?",
     "tunnel_starting":  "Démarrage du tunnel...",
     "tunnel_started":  "Tunnel démarré",
-  "tunnel_waiting_url": "Tunnel démarré. En attente de l'URL publique...",
-  "tunnel_no_public_url": "L'URL publique apparaîtra ici après le démarrage du tunnel.",
+    "tunnel_waiting_url":  "Tunnel démarré. En attente de l\u0027URL publique...",
+    "tunnel_no_public_url":  "L\u0027URL publique apparaîtra ici après le démarrage du tunnel.",
     "tunnels_hint":  "Les tunnels rapides exposent ce panneau local sur Internet. Gardez des identifiants administrateur robustes et partagez les URL publiques uniquement avec des utilisateurs de confiance.",
     "ngrok_authtoken_placeholder":  "ngrok authtoken (optionnel pour certains comptes)",
     "import_users_title":  "📤 Import Utilisateurs",
@@ -294,7 +294,7 @@
     "deleting":  "Suppression...",
     "my_connections_title":  "Mes Connexions",
     "show_config":  "📄 Voir config",
-  "no_connections_user_desc": "Contactez l'admin pour une connexion",
+    "no_connections_user_desc":  "Contactez l\u0027admin pour une connexion",
     "share_title":  "Accès Connexion",
     "vpn_access":  "Accès VPN",
     "user_label_share":  "Utilisateur",
@@ -313,7 +313,7 @@
     "invalid_captcha":  "Captcha invalide",
     "account_disabled":  "Compte désactivé",
     "invalid_login":  "Login ou password incorrect",
-  "user_exists": "L'utilisateur existe déjà",
+    "user_exists":  "L\u0027utilisateur existe déjà",
     "cannot_delete_self":  "Vous ne pouvez pas vous supprimer",
     "wrong_share_password":  "Mauvais mot de passe",
     "saving":  "Enregistrement...",
@@ -326,11 +326,11 @@
     "backup_title":  "Sauvegarde Simple",
     "download_backup":  "Télécharger data.json",
     "restore_backup":  "Restaurer depuis un fichier",
-  "restore_confirm": "Êtes-vous sûr ? Les données actuelles seront écrasées et l'application redémarrera.",
+    "restore_confirm":  "Êtes-vous sûr ? Les données actuelles seront écrasées et l\u0027application redémarrera.",
     "restore_success":  "Restauration réussie ! Redémarrage...",
     "invalid_backup_file":  "Fichier de sauvegarde ou structure invalide",
     "config_unavailable":  "Configuration indisponible",
-  "config_unavailable_desc": "Ce client a été créé via l'application native Amnezia.\\nLa clé privée est stockée uniquement sur l'appareil de l'utilisateur et ne peut pas être récupérée par le serveur.",
+    "config_unavailable_desc":  "Ce client a été créé via l\u0027application native Amnezia.\\nLa clé privée est stockée uniquement sur l\u0027appareil de l\u0027utilisateur et ne peut pas être récupérée par le serveur.",
     "client_public_key":  "Clé publique du client :",
     "management":  "Gestion",
     "server_management":  "Gestion du serveur",
@@ -340,6 +340,31 @@
     "clear_server":  "Réinitialiser le serveur",
     "remove_server":  "Retirer le serveur du panneau",
     "telemt_desc":  "Proxy Telegram basé sur MTProxy avec obfuscation avancée.",
+    "hysteria_desc":  "Hysteria 2 (QUIC/UDP) via l\u0027image officielle tobyxdd/hysteria (apernet/hysteria) avec TLS Let\u0027s Encrypt. Le domaine est défini par l\u0027admin à l\u0027installation.",
+    "hysteria_domain":  "Domaine",
+    "hysteria_email":  "Email Let\u0027s Encrypt",
+    "hysteria_port_hint":  "Port UDP pour Hysteria (8998 par défaut). Évitez 443 s\u0027il est déjà pris.",
+    "hysteria_install_hint":  "L\u0027enregistrement A du domaine doit pointer vers ce serveur. BBR et obfuscation salamander sont activés automatiquement.",
+    "hysteria_dns_hint":  "Créez cet enregistrement DNS avant l\u0027installation :",
+    "hysteria_settings_title":  "Paramètres Hysteria",
+    "hysteria_change_port":  "Changer le port",
+    "hysteria_port_change_hint":  "Port UDP. Si « address already in use », choisissez un port libre (8443 ou 8998).",
+    "hysteria_settings_saved":  "Port Hysteria mis à jour",
+    "hysteria_ports_warning":  "Attention : les ports TCP 80 et 443 doivent être libres pour un fonctionnement stable (Let\u0027s Encrypt sur 80, HTTPS/QUIC sur 443).",
+    "hysteria_renew_ssl":  "Renouveler SSL",
+    "hysteria_ssl_change_hint":  "Changer le domaine réémet le certificat Let\u0027s Encrypt (le port 80 doit être libre).",
+    "hysteria_ssl_required":  "Domaine et email requis pour SSL",
+    "naiveproxy_desc":  "NaiveProxy (stable) — HTTPS/HTTP2 via Caddy + forwardproxy, TLS Let\u0027s Encrypt. Client : utilisez Karing. N\u0027utilisez pas v2rayN ; autres clients non testés.",
+    "naiveproxy_domain":  "Domaine",
+    "naiveproxy_email":  "Email Let\u0027s Encrypt",
+    "naiveproxy_port_hint":  "Le port TCP 443 est fixe pour NaiveProxy. Le port 80/TCP doit être libre pour l\u0027émission du certificat.",
+    "naiveproxy_install_hint":  "L\u0027enregistrement A du domaine doit pointer vers ce serveur. Les ports TCP 80 et 443 doivent être libres (Let\u0027s Encrypt et proxy HTTPS).",
+    "naiveproxy_dns_hint":  "Créez cet enregistrement DNS avant l\u0027installation :",
+    "naiveproxy_ports_warning":  "Attention : les ports TCP 80 et 443 doivent être libres pour un fonctionnement stable (Let\u0027s Encrypt sur 80, proxy HTTPS sur 443).",
+    "naiveproxy_client_hint":  "Version stable. N\u0027utilisez PAS v2rayN. Fonctionne avec Karing. Autres clients non testés.",
+    "server_ssl_domain":  "Domaine SSL (par défaut)",
+    "server_ssl_email":  "Email SSL (par défaut)",
+    "server_ssl_hint":  "Utilisé lors de l\u0027installation de Hysteria / NGINX sur ce serveur (Let\u0027s Encrypt).",
     "container_logs":  "Logs du conteneur",
     "logs_btn":  "📋 Logs",
     "logs_live":  "Temps réel",
@@ -384,7 +409,7 @@
     "ping_checking":  "Checking connectivity...",
     "offline":  "offline",
     "api_tokens_title":  "API tokens",
-  "api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
+    "api_tokens_hint":  "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer \u003ctoken\u003e` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
     "api_tokens_empty":  "No API tokens yet. Create one to integrate the panel with an external service.",
     "api_tokens_create":  "Create token",
     "api_tokens_create_title":  "Create API token",
@@ -394,8 +419,8 @@
     "api_tokens_name_required":  "Token name is required",
     "api_tokens_created_title":  "Token created",
     "api_tokens_value_label":  "Token value",
-  "api_tokens_warning_title": "This is the only time you'll see this token.",
-  "api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
+    "api_tokens_warning_title":  "This is the only time you\u0027ll see this token.",
+    "api_tokens_warning_body":  "Copy it now and store it in your integration\u0027s secret manager. The panel keeps only a hash — if you lose this value you\u0027ll need to revoke and recreate the token.",
     "api_tokens_revoke":  "Revoke",
     "api_tokens_revoke_confirm":  "Revoke token \"{}\"? Any integration using it will stop working.",
     "api_tokens_revoked":  "Token revoked",
@@ -445,10 +470,10 @@
     "new_instance":  "new instance",
     "port_next_instance_hint":  "Choose a free UDP port for the additional instance.",
     "web_servers":  "Serveurs web",
-  "nginx_desc": "Serveur web NGINX avec certificat HTTPS Let's Encrypt et index.html modifiable.",
+    "nginx_desc":  "Serveur web NGINX avec certificat HTTPS Let\u0027s Encrypt et index.html modifiable.",
     "nginx_domain":  "Domaine",
-  "nginx_email": "Email Let's Encrypt",
-  "nginx_port_hint": "Port HTTPS exposé sur le serveur. Le port 80/TCP doit être libre et accessible pour la validation Let's Encrypt.",
+    "nginx_email":  "Email Let\u0027s Encrypt",
+    "nginx_port_hint":  "Port HTTPS exposé sur le serveur. Le port 80/TCP doit être libre et accessible pour la validation Let\u0027s Encrypt.",
     "nginx_install_hint":  "Le domaine doit déjà pointer vers ce serveur. Le port 80/TCP est utilisé pour la validation HTTP-01 du certificat.",
     "site":  "Site",
     "site_editor":  "Éditeur du site",
@@ -463,17 +488,17 @@
     "no_backups":  "No backups yet",
     "no_backups_desc":  "Create the first backup for this protocol.",
     "refresh":  "Refresh",
-  "guest_allow_create_hint": "Crée une config pour l'utilisateur invité (3x-ui VLESS ou protocole serveur).",
-  "invite_inbound_hint": "Choisissez l'inbound VLESS une fois",
+    "guest_allow_create_hint":  "Crée une config pour l\u0027utilisateur invité (3x-ui VLESS ou protocole serveur).",
+    "invite_inbound_hint":  "Choisissez l\u0027inbound VLESS une fois",
     "invite_inbound_loading":  "Chargement…",
     "invite_inbound_empty":  "Aucun inbound VLESS",
-  "invite_inbound_need_xui": "Configurez 3x-ui d'abord",
+    "invite_inbound_need_xui":  "Configurez 3x-ui d\u0027abord",
     "invite_inbound_required":  "Sélectionnez un inbound VLESS",
-  "invite_sub_url_missing_title": "URL d'abonnement manquante",
-  "invite_sub_url_missing_hint": "Dans Paramètres → 3x-ui, définissez l'URL de base /sub.",
+    "invite_sub_url_missing_title":  "URL d\u0027abonnement manquante",
+    "invite_sub_url_missing_hint":  "Dans Paramètres → 3x-ui, définissez l\u0027URL de base /sub.",
     "xui_url_label":  "URL 3x-ui",
     "xui_url_hint":  "Inclure le schéma, le port et webBasePath si configuré",
-  "xui_sub_url_label": "URL de base d'abonnement",
+    "xui_sub_url_label":  "URL de base d\u0027abonnement",
     "xui_sub_url_hint":  "Base /sub publique sans slash final (ex: https://host:2096/sub).",
     "xui_api_token_label":  "Jeton API (préféré)",
     "xui_api_token_placeholder":  "Settings → Security → API Token",
@@ -483,15 +508,32 @@
     "xui_sync_hint":  "Les clients 3x-ui deviennent des utilisateurs du panneau (liés par email)",
     "xui_inbound_label":  "Inbound VLESS",
     "xui_inbound_auto":  "Auto (premier inbound VLESS)",
-  "xui_inbound_hint": "Utilisé pour créer des configs 3x-ui VLESS. Créez d'abord un inbound VLESS dans 3x-ui.",
+    "xui_inbound_hint":  "Utilisé pour créer des configs 3x-ui VLESS. Créez d\u0027abord un inbound VLESS dans 3x-ui.",
     "xui_servers_title":  "Serveurs 3x-ui",
-  "xui_servers_hint": "Ajoutez plusieurs panneaux 3x-ui. À la création, choisissez le serveur par nom — son URL d'abonnement est utilisée.",
+    "xui_servers_hint":  "Ajoutez plusieurs panneaux 3x-ui. À la création, choisissez le serveur par nom — son URL d\u0027abonnement est utilisée.",
     "xui_servers_empty":  "Aucun serveur 3x-ui. Cliquez sur Ajouter.",
-  "xui_servers_manage_hint": "Les URL et bases d'abonnement se gèrent dans la section « Serveurs 3x-ui » ci-dessous.",
+    "xui_servers_manage_hint":  "Les URL et bases d\u0027abonnement se gèrent dans la section « Serveurs 3x-ui » ci-dessous.",
     "xui_server_add":  "Ajouter un serveur",
     "xui_server_name_label":  "Nom / description",
     "xui_server_name_hint":  "Affiché dans les invitations (ex: US, NL).",
     "xui_server_select_label":  "Serveur 3x-ui",
-  "xui_server_select_hint": "Choisissez le panneau 3x-ui qui émettra l'URL d'abonnement.",
+    "xui_server_select_hint":  "Choisissez le panneau 3x-ui qui émettra l\u0027URL d\u0027abonnement.",
     "xui_server_delete_confirm":  "Supprimer ce serveur 3x-ui ?"
+,
+    "about_title":  "About & Updates",
+    "current_version":  "Current version",
+    "check_updates":  "Check for updates",
+    "checking_updates":  "Checking...",
+    "update_available":  "New version available",
+    "download_update":  "Download update",
+    "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release."
 }

translations/ru.json

@@ -153,6 +153,7 @@
     "server_label":  "Сервер",
     "no_create_conn":  "— Не создавать подключение —",
     "protocol_label":  "Протокол",
+    "server_then_protocol_hint":  "Сначала выберите сервер, затем протокол, установленный на нём (WireGuard, AmneziaWG 2.0 и т.д.).",
     "edit_user_title":  "Редактировать пользователя: {}",
     "edit_user_tg":  "Telegram ID (опционально)",
     "edit_user_email":  "Email (опционально)",
@@ -349,6 +350,31 @@
     "config_unavailable_desc":  "Этот клиент был создан через нативное приложение Amnezia.\\nПриватный ключ хранится только на устройстве пользователя и не может быть восстановлен сервером.",
     "client_public_key":  "Публичный ключ клиента:",
     "telemt_desc":  "Прокси для Telegram на базе MTProxy с продвинутой обфускацией и эмуляцией TLS.",
+    "hysteria_desc":  "Hysteria 2 (QUIC/UDP) на официальном образе tobyxdd/hysteria (apernet/hysteria) с TLS от Let\u0027s Encrypt. Домен указывает админ при установке.",
+    "hysteria_domain":  "Домен",
+    "hysteria_email":  "Email для Let\u0027s Encrypt",
+    "hysteria_port_hint":  "UDP-порт Hysteria (по умолчанию 8998). Не ставьте 443, если он уже занят nginx/xray. Порт 80/TCP должен быть свободен для выпуска сертификата.",
+    "hysteria_install_hint":  "Перед установкой A-запись домена должна указывать на этот сервер. Порт 80/TCP временно используется для HTTP-01 проверки Let\u0027s Encrypt. BBR и obfuscation salamander включаются автоматически.",
+    "hysteria_dns_hint":  "Перед установкой создайте DNS-запись:",
+    "hysteria_settings_title":  "Настройки Hysteria",
+    "hysteria_change_port":  "Сменить порт",
+    "hysteria_port_change_hint":  "UDP-порт прослушивания. Если ошибка «address already in use» — выберите свободный порт (8443 или 8998), сохраните и заново импортируйте ссылку в клиент.",
+    "hysteria_settings_saved":  "Настройки Hysteria обновлены",
+    "hysteria_ports_warning":  "Внимание: для стабильной работы нужны свободные TCP-порты 80 и 443 (Let\u0027s Encrypt на 80, HTTPS/QUIC на 443).",
+    "hysteria_renew_ssl":  "Обновить SSL",
+    "hysteria_ssl_change_hint":  "Смена домена заново выпускает сертификат Let\u0027s Encrypt (порт 80 должен быть свободен).",
+    "hysteria_ssl_required":  "Для SSL нужны домен и email",
+    "naiveproxy_desc":  "NaiveProxy (стабильный) — HTTPS/HTTP2 через Caddy + forwardproxy, TLS Let\u0027s Encrypt. Клиент: используйте Karing. Не используйте v2rayN; остальные клиенты под вопросом.",
+    "naiveproxy_domain":  "Домен",
+    "naiveproxy_email":  "Email для Let\u0027s Encrypt",
+    "naiveproxy_port_hint":  "TCP-порт 443 фиксирован для NaiveProxy. Порт 80/TCP должен быть свободен для выпуска сертификата.",
+    "naiveproxy_install_hint":  "Перед установкой A-запись домена должна указывать на этот сервер. Нужны свободные TCP-порты 80 и 443 (Let\u0027s Encrypt и HTTPS-прокси).",
+    "naiveproxy_dns_hint":  "Перед установкой создайте DNS-запись:",
+    "naiveproxy_ports_warning":  "Внимание: для стабильной работы нужны свободные TCP-порты 80 и 443 (Let\u0027s Encrypt на 80, HTTPS-прокси на 443).",
+    "naiveproxy_client_hint":  "Стабильная версия. НЕ используйте v2rayN. Точно работает в Karing. Остальные клиенты под вопросом.",
+    "server_ssl_domain":  "SSL-домен (по умолчанию)",
+    "server_ssl_email":  "SSL-email (по умолчанию)",
+    "server_ssl_hint":  "Подставляется при установке Hysteria / NGINX на этом сервере (Let\u0027s Encrypt).",
     "container_logs":  "Логи контейнера",
     "logs_btn":  "📋 Логи",
     "logs_live":  "В реальном времени",
@@ -407,7 +433,7 @@
     "ping_checking":  "Проверяем соединение...",
     "offline":  "недоступен",
     "api_tokens_title":  "API-токены",
-  "api_tokens_hint": "Bearer-токены для внешних интеграций. Передавайте токен в заголовке `Authorization: Bearer <token>`. Токены имеют права администратора и перестают работать, если их владелец отключён или понижен в роли.",
+    "api_tokens_hint":  "Bearer-токены для внешних интеграций. Передавайте токен в заголовке `Authorization: Bearer \u003ctoken\u003e`. Токены имеют права администратора и перестают работать, если их владелец отключён или понижен в роли.",
     "api_tokens_empty":  "Пока нет ни одного API-токена. Создайте, чтобы подключить панель к внешнему сервису.",
     "api_tokens_create":  "Создать токен",
     "api_tokens_create_title":  "Создание API-токена",
@@ -455,6 +481,15 @@
     "update_available":  "Доступна новая версия",
     "download_update":  "Скачать обновление",
     "up_to_date":  "У вас установлена последняя версия",
+    "apply_update":  "Установить обновление",
+    "applying_update":  "Обновление…",
+    "apply_update_confirm":  "Установить обновление с git.evilfox.cc и перезапустить панель?",
+    "update_restarting":  "Обновлено. Перезапуск панели…",
+    "update_no_target":  "Нет целевой версии. Сначала проверьте обновления.",
+    "auto_update_hint":  "Автообновление тянет тег релиза с git.evilfox.cc (нужен git clone панели).",
+    "auto_update_ready":  "Для этой установки доступно автообновление через git.",
+    "auto_update_docker":  "Docker: пересоберите/подтяните образ или используйте git clone для обновления в один клик.",
+    "auto_update_manual":  "Обновление в один клик требует git clone. Можно скачать релиз вручную.",
     "warp_hint":  "WARP направляет исходящий трафик этого хоста через Cloudflare. Он не создаёт публичный URL панели как Quick Tunnel или ngrok.",
     "warp_install_hint":  "Сначала установите официальный клиент Cloudflare WARP, затем перезапустите панель.",
     "warp_install_required":  "Сначала установите WARP",
@@ -493,10 +528,10 @@
     "port_next_instance_hint":  "Выберите свободный UDP-порт для дополнительного экземпляра.",
     "checking_server":  "Проверяем сервисы сервера...",
     "web_servers":  "Веб-серверы",
-  "nginx_desc": "NGINX веб-сервер с HTTPS-сертификатом Let's Encrypt и редактируемым index.html.",
+    "nginx_desc":  "NGINX веб-сервер с HTTPS-сертификатом Let\u0027s Encrypt и редактируемым index.html.",
     "nginx_domain":  "Домен",
-  "nginx_email": "Email для Let's Encrypt",
-  "nginx_port_hint": "HTTPS-порт на сервере. Порт 80/TCP должен быть свободен и доступен для проверки Let's Encrypt.",
+    "nginx_email":  "Email для Let\u0027s Encrypt",
+    "nginx_port_hint":  "HTTPS-порт на сервере. Порт 80/TCP должен быть свободен и доступен для проверки Let\u0027s Encrypt.",
     "nginx_install_hint":  "Домен уже должен указывать на этот сервер. Порт 80/TCP используется для HTTP-01 проверки сертификата.",
     "site":  "Сайт",
     "site_editor":  "Редактор сайта",

translations/zh.json

@@ -340,6 +340,31 @@
     "clear_server":  "清除服务器",
     "remove_server":  "从面板移除服务器",
     "telemt_desc":  "基于 MTProxy 的 Telegram 代理，支持高级混淆。",
+    "hysteria_desc":  "Hysteria 2（QUIC/UDP，官方 tobyxdd/hysteria / apernet/hysteria），支持 Let\u0027s Encrypt TLS。安装时由管理员指定域名。",
+    "hysteria_domain":  "域名",
+    "hysteria_email":  "Let\u0027s Encrypt 邮箱",
+    "hysteria_port_hint":  "Hysteria UDP 端口（默认 8998）。若 443 已被占用请换端口。",
+    "hysteria_install_hint":  "安装前请将域名 A 记录指向本服务器。将自动启用 BBR 与 salamander 混淆。",
+    "hysteria_dns_hint":  "安装前请创建此 DNS 记录：",
+    "hysteria_settings_title":  "Hysteria 设置",
+    "hysteria_change_port":  "更改端口",
+    "hysteria_port_change_hint":  "UDP 监听端口。若提示 address already in use，请改用空闲端口（如 8443 或 8998）。",
+    "hysteria_settings_saved":  "Hysteria 端口已更新",
+    "hysteria_ports_warning":  "注意：稳定运行需要空闲的 TCP 端口 80 和 443（Let\u0027s Encrypt 使用 80，HTTPS/QUIC 使用 443）。",
+    "hysteria_renew_ssl":  "续签 SSL",
+    "hysteria_ssl_change_hint":  "更改域名会重新签发 Let\u0027s Encrypt 证书（需空闲端口 80）。",
+    "hysteria_ssl_required":  "签发 SSL 需要域名和邮箱",
+    "naiveproxy_desc":  "NaiveProxy（稳定）— Caddy + forwardproxy 的 HTTPS/HTTP2，Let\u0027s Encrypt TLS。客户端请用 Karing，不要用 v2rayN；其他客户端未测试。",
+    "naiveproxy_domain":  "域名",
+    "naiveproxy_email":  "Let\u0027s Encrypt 邮箱",
+    "naiveproxy_port_hint":  "NaiveProxy 固定使用 TCP 443。签发证书需空闲 TCP 80。",
+    "naiveproxy_install_hint":  "安装前请将域名 A 记录指向本服务器。需空闲 TCP 端口 80 和 443（Let\u0027s Encrypt 与 HTTPS 代理）。",
+    "naiveproxy_dns_hint":  "安装前请创建此 DNS 记录：",
+    "naiveproxy_ports_warning":  "注意：稳定运行需要空闲的 TCP 端口 80 和 443（Let\u0027s Encrypt 使用 80，HTTPS 代理使用 443）。",
+    "naiveproxy_client_hint":  "稳定版。请勿使用 v2rayN。已确认 Karing 可用。其他客户端未测试。",
+    "server_ssl_domain":  "SSL 域名（默认）",
+    "server_ssl_email":  "SSL 邮箱（默认）",
+    "server_ssl_hint":  "安装 Hysteria / NGINX 时自动填入（Let\u0027s Encrypt）。",
     "container_logs":  "容器日志",
     "logs_btn":  "📋 日志",
     "logs_live":  "实时",
@@ -384,7 +409,7 @@
     "ping_checking":  "Checking connectivity...",
     "offline":  "offline",
     "api_tokens_title":  "API tokens",
-  "api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
+    "api_tokens_hint":  "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer \u003ctoken\u003e` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
     "api_tokens_empty":  "No API tokens yet. Create one to integrate the panel with an external service.",
     "api_tokens_create":  "Create token",
     "api_tokens_create_title":  "Create API token",
@@ -394,8 +419,8 @@
     "api_tokens_name_required":  "Token name is required",
     "api_tokens_created_title":  "Token created",
     "api_tokens_value_label":  "Token value",
-  "api_tokens_warning_title": "This is the only time you'll see this token.",
-  "api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
+    "api_tokens_warning_title":  "This is the only time you\u0027ll see this token.",
+    "api_tokens_warning_body":  "Copy it now and store it in your integration\u0027s secret manager. The panel keeps only a hash — if you lose this value you\u0027ll need to revoke and recreate the token.",
     "api_tokens_revoke":  "Revoke",
     "api_tokens_revoke_confirm":  "Revoke token \"{}\"? Any integration using it will stop working.",
     "api_tokens_revoked":  "Token revoked",
@@ -445,10 +470,10 @@
     "new_instance":  "new instance",
     "port_next_instance_hint":  "Choose a free UDP port for the additional instance.",
     "web_servers":  "Web servers",
-  "nginx_desc": "NGINX web server with Let's Encrypt HTTPS certificate and editable index.html.",
+    "nginx_desc":  "NGINX web server with Let\u0027s Encrypt HTTPS certificate and editable index.html.",
     "nginx_domain":  "Domain",
-  "nginx_email": "Let's Encrypt email",
-  "nginx_port_hint": "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let's Encrypt validation.",
+    "nginx_email":  "Let\u0027s Encrypt email",
+    "nginx_port_hint":  "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let\u0027s Encrypt validation.",
     "nginx_install_hint":  "The domain must already point to this server. Port 80/TCP is used for HTTP-01 certificate validation.",
     "site":  "Site",
     "site_editor":  "Site editor",
@@ -494,4 +519,21 @@
     "xui_server_select_label":  "3x-ui 服务器",
     "xui_server_select_hint":  "选择签发订阅 URL 的 3x-ui 面板。",
     "xui_server_delete_confirm":  "从面板删除此 3x-ui 服务器？"
+,
+    "about_title":  "About & Updates",
+    "current_version":  "Current version",
+    "check_updates":  "Check for updates",
+    "checking_updates":  "Checking...",
+    "update_available":  "New version available",
+    "download_update":  "Download update",
+    "up_to_date":  "You have the latest version",
+    "apply_update":  "Install update",
+    "applying_update":  "Updating…",
+    "apply_update_confirm":  "Install update from git.evilfox.cc and restart the panel?",
+    "update_restarting":  "Updated. Restarting panel…",
+    "update_no_target":  "No target version. Check for updates first.",
+    "auto_update_hint":  "Auto-update pulls the release tag from git.evilfox.cc (git checkout required).",
+    "auto_update_ready":  "Git auto-update is available for this install.",
+    "auto_update_docker":  "Docker install: rebuild/pull image, or use a git checkout for one-click update.",
+    "auto_update_manual":  "One-click update needs a git clone. You can still download a release."
 }