Fix mita RPC socket path and rate-limit heal recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -277,6 +277,18 @@ GitHub Actions workflows in `.github/workflows/`:
 
 ## 📋 Fix / changelog (this fork)
 
+### v2.6.5
+*   **Mieru install fix** — wait for `/var/run/mita.sock`, seed a bootstrap user (empty `users` caused `mita start` RPC EOF), retry apply/start with systemd restart.
+
+### v2.6.4
+*   **Mieru (mita v3.28.0)** — optional per-server install from [enfein/mieru](https://github.com/enfein/mieru): native Debian/RPM package, no Docker. Marketplace + server card, TCP port at install, user connections with `mierus://` share links. Pinned release **v3.28.0** (GitHub has no v2.8.0 tag).
+
+### v2.6.3
+*   **Client connection domain (AWG / WireGuard)** — set a DNS name per server (or per AWG/WG protocol) instead of IP in client configs (`Endpoint = domain:port`). Survives server IP changes — update the A-record only. UI on server list, server page, and when adding a server.
+*   **Legacy `data.json` → PostgreSQL** — import normalizes old backups (UUIDs, duplicate usernames/tokens, string `server_info`); failed auto-import no longer bricks panel startup; JSON restore returns clear errors.
+*   **Dokploy / Traefik 404** — `traefik.http.services.amnezia_panel.loadbalancer.server.port=5000` in compose (Traefik must route to container port **5000**).
+*   **Support the project** — `/support` page for all users (SBP / card / crypto placeholders); admin configures requisites in **Settings** (no popups).
+
 ### v2.6.2
 *   **Panel backup → PostgreSQL dump** — Settings backup downloads `.sql` via `pg_dump`; restore accepts `.sql` or legacy `data.json`. JSON export kept as secondary link.
 
@@ -407,6 +419,9 @@ TOKEN="awp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 # List panel users
 curl -H "Authorization: Bearer $TOKEN" http://your-panel:5000/api/users
 
+# List SSH servers (no credentials in response)
+curl -H "Authorization: Bearer $TOKEN" http://your-panel:5000/api/servers
+
 # Add a server
 curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   -d '{"host":"1.2.3.4","username":"root","password":"...","name":"new-srv"}' \

app.py

@@ -103,7 +103,7 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.6.5"
+CURRENT_VERSION = "v2.6.9"
 RELEASES_REPO_URL = repo_url()
 RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
@@ -241,12 +241,14 @@ def get_current_user(request: Request, data: Optional[dict] = None):
 def tpl(request, template, **kwargs):
     data = load_data()
     lang = request.cookies.get('lang', 'en')
+    donate_cfg = (data.get('settings') or {}).get('donate') or {}
     ctx = {
         'request': request,
         'current_user': get_current_user(request, data),
         'site_settings': data.get('settings', {}).get('appearance', {}),
         'captcha_settings': data.get('settings', {}).get('captcha', {}),
         'telegram_settings': data.get('settings', {}).get('telegram', {}),
+        'donate_enabled': bool(donate_cfg.get('enabled', True)),
         'bot_running': tg_bot.is_running(),
         'lang': lang,
         '_': lambda text_id: _t(text_id, lang),
@@ -1109,8 +1111,9 @@ async def wait_for_tunnel_url(provider: str, seconds: int = 20):
     return get_tunnel_status(provider)
 
 
-BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
+BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'mieru', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
 MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'}
+NON_DOCKER_PROTOCOLS = frozenset({'mieru'})
 
 
 def protocol_base(protocol: str) -> str:
@@ -1152,6 +1155,7 @@ def protocol_display_name(protocol: str) -> str:
         'telemt': 'Telemt',
         'hysteria': 'Hysteria 2',
         'naiveproxy': 'NaiveProxy',
+        'mieru': 'Mieru',
         'dns': 'AmneziaDNS',
         'wireguard': 'WireGuard',
         'socks5': 'SOCKS5',
@@ -1173,6 +1177,7 @@ def protocol_container_name(protocol: str) -> Optional[str]:
         'telemt': 'telemt',
         'hysteria': 'amnezia-hysteria',
         'naiveproxy': 'amnezia-naiveproxy',
+        'mieru': 'mita',
         'dns': 'amnezia-dns',
         'wireguard': 'amnezia-wireguard',
         'socks5': 'amnezia-socks5proxy',
@@ -1218,6 +1223,9 @@ def get_protocol_manager(ssh, protocol: str):
     elif base == 'naiveproxy':
         from managers.naiveproxy_manager import NaiveProxyManager
         return NaiveProxyManager(ssh, protocol)
+    elif base == 'mieru':
+        from managers.mieru_manager import MieruManager
+        return MieruManager(ssh, protocol)
     from managers.awg_manager import AWGManager
     return AWGManager(ssh)
 
@@ -1279,7 +1287,7 @@ def _manager_call(manager, method, protocol, *args, **kwargs):
 
 
 # Protocols that own VPN clients (can list/link connections)
-CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'hysteria', 'naiveproxy', 'xui'}
+CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'hysteria', 'naiveproxy', 'mieru', 'xui'}
 
 
 def generate_vpn_link(config_text):
@@ -1346,6 +1354,30 @@ def _touch_api_token(token_entry: dict) -> bool:
     return True
 
 
+def _schedule_api_token_touch(token_id: str) -> None:
+    """Persist API token last_used_at without blocking the request handler."""
+    try:
+        loop = asyncio.get_running_loop()
+    except RuntimeError:
+        return
+    loop.create_task(_persist_api_token_touch(token_id))
+
+
+async def _persist_api_token_touch(token_id: str) -> None:
+    try:
+        async with DATA_LOCK:
+            data = await load_data_async()
+            entry = next(
+                (t for t in data.get('api_tokens', []) if t.get('id') == token_id),
+                None,
+            )
+            if not entry or not _touch_api_token(entry):
+                return
+            await asyncio.to_thread(save_data, data)
+    except Exception as e:
+        logger.warning(f"Failed to touch API token last_used_at: {e}")
+
+
 def hash_password(password: str) -> str:
     salt = secrets.token_hex(16)
     h = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 100000)
@@ -2359,6 +2391,20 @@ class GuestSettings(BaseModel):
     create_xui_panel_id: str = ''
 
 
+class DonateMethodSettings(BaseModel):
+    enabled: bool = True
+    title: str = ''
+    details: str = ''
+
+
+class DonateSettings(BaseModel):
+    enabled: bool = True
+    intro: str = ''
+    sbp: DonateMethodSettings = DonateMethodSettings()
+    card: DonateMethodSettings = DonateMethodSettings()
+    crypto: DonateMethodSettings = DonateMethodSettings()
+
+
 class UpdateUserRequest(BaseModel):
     telegramId: Optional[str] = None
     email: Optional[str] = None
@@ -2379,6 +2425,7 @@ class SaveSettingsRequest(BaseModel):
     telegram: TelegramSettings
     ssl: SSLSettings
     guest: GuestSettings = GuestSettings()
+    donate: DonateSettings = DonateSettings()
 
 
 class ToggleUserRequest(BaseModel):
@@ -2921,18 +2968,83 @@ def _check_admin(request):
         resolved = _resolve_api_token(data, raw_token)
         if resolved:
             entry, token_user = resolved
-            # Best-effort last-used tracking; swallow write errors so a flaky
+            if _touch_api_token(entry):
-            # disk never blocks an API call from succeeding.
+                token_id = entry.get('id')
-            try:
+                if token_id:
-                if _touch_api_token(entry):
+                    _schedule_api_token_touch(token_id)
-                    save_data(data)
-            except Exception as e:
-                logger.warning(f"Failed to touch API token last_used_at: {e}")
             return token_user
 
     return None
 
 
+async def _check_admin_async(request):
+    """Async variant for hot paths (server list/ping) — avoids blocking the loop."""
+    user = get_current_user(request)
+    if user and user['role'] in ('admin', 'support'):
+        return user
+
+    auth_header = request.headers.get('Authorization', '')
+    if auth_header.lower().startswith('bearer '):
+        raw_token = auth_header[7:].strip()
+        data = await load_data_async()
+        resolved = _resolve_api_token(data, raw_token)
+        if resolved:
+            entry, token_user = resolved
+            if _touch_api_token(entry):
+                token_id = entry.get('id')
+                if token_id:
+                    _schedule_api_token_touch(token_id)
+            return token_user
+
+    return None
+
+
+def _public_vpn_server_view(server: dict, server_id: int) -> dict:
+    """Safe server list view for API consumers (no SSH secrets)."""
+    server_info = dict(server.get('server_info') or {})
+    for key in list(server_info.keys()):
+        if key not in ('uname', 'ssl_domain', 'ssl_email', 'connect_domain'):
+            server_info.pop(key, None)
+
+    protocols = {}
+    for key, info in (server.get('protocols') or {}).items():
+        if not isinstance(info, dict):
+            continue
+        protocols[key] = {
+            'installed': bool(info.get('installed')),
+            'port': info.get('port'),
+            'running': info.get('running'),
+            'container_exists': info.get('container_exists'),
+        }
+
+    return {
+        'id': server_id,
+        'name': server.get('name') or server.get('host') or '',
+        'host': server.get('host') or '',
+        'ssh_port': int(server.get('ssh_port') or 22),
+        'username': server.get('username') or '',
+        'auth': 'key' if server.get('private_key') else 'password',
+        'has_password': bool(server.get('password')),
+        'has_private_key': bool(server.get('private_key')),
+        'server_info': server_info,
+        'protocols': protocols,
+    }
+
+
+@app.get('/api/servers', tags=["Servers"])
+async def api_list_servers(request: Request):
+    """List SSH servers in the panel inventory (credentials are never returned)."""
+    if not await _check_admin_async(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    data = await load_data_async()
+    servers = [
+        _public_vpn_server_view(s, idx)
+        for idx, s in enumerate(data.get('servers', []))
+        if isinstance(s, dict)
+    ]
+    return {'servers': servers, 'total': len(servers)}
+
+
 @app.post('/api/servers/add', tags=["Servers"])
 async def api_add_server(request: Request, req: AddServerRequest):
     if not _check_admin(request):
@@ -3143,9 +3255,9 @@ async def api_server_ping(request: Request, server_id: int):
     measures RTT, immediately closes. Runs on the asyncio loop so the page
     can issue many pings in parallel without blocking each other.
     """
-    if not _check_admin(request):
+    if not await _check_admin_async(request):
         return JSONResponse({'error': 'Forbidden'}, status_code=403)
-    data = load_data()
+    data = await load_data_async()
     if server_id >= len(data['servers']):
         return JSONResponse({'error': 'Server not found'}, status_code=404)
     server = data['servers'][server_id]
@@ -3449,6 +3561,12 @@ async def api_check_server(request: Request, server_id: int):
                                 merged[key] = db_proto[key]
                         if db_proto.get('port') and not merged.get('port'):
                             merged['port'] = db_proto['port']
+                    if protocol_base(proto) == 'mieru':
+                        for key in ('release',):
+                            if db_proto.get(key) not in (None, '') and not merged.get(key):
+                                merged[key] = db_proto[key]
+                        if db_proto.get('port') and not merged.get('port'):
+                            merged['port'] = db_proto['port']
                     return merged
 
                 def should_preserve_saved_protocol(proto, result=None, err=None):
@@ -3463,8 +3581,9 @@ async def api_check_server(request: Request, server_id: int):
 
                 def check_proto(proto):
                     cname = protocol_container_name(proto)
+                    base = protocol_base(proto)
                     # Fast path: skip deep manager probes when container is absent
-                    if cname and cname not in inventory:
+                    if cname and cname not in inventory and base not in NON_DOCKER_PROTOCOLS:
                         return proto, merge_saved_protocol_status(proto, {
                             'container_exists': False,
                             'container_running': False,
@@ -3557,7 +3676,9 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
 
         ssh = get_ssh(server)
         ssh.connect()
-        docker_install_log = ensure_docker_installed(ssh)
+        docker_install_log = ''
+        if install_base not in NON_DOCKER_PROTOCOLS:
+            docker_install_log = ensure_docker_installed(ssh)
         manager = get_protocol_manager(ssh, install_protocol)
 
         # Pass parameters to installer
@@ -3614,6 +3735,11 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
                 domain=req.naiveproxy_domain,
                 email=req.naiveproxy_email,
             )
+        elif install_base == 'mieru':
+            result = manager.install_protocol(
+                protocol_type=install_protocol,
+                port=req.port,
+            )
         else:
             result = manager.install_protocol(install_protocol, port=req.port)
 
@@ -3663,6 +3789,11 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
             proto_record['email'] = result.get('email')
             if result.get('port'):
                 proto_record['port'] = str(result['port'])
+        if install_base == 'mieru':
+            if result.get('port'):
+                proto_record['port'] = str(result['port'])
+            if result.get('release'):
+                proto_record['release'] = result.get('release')
         proto_record['base_protocol'] = install_base
         proto_record['instance'] = protocol_instance(install_protocol)
         proto_record['display_name'] = protocol_display_name(install_protocol)
@@ -3850,6 +3981,7 @@ CONTAINER_NAMES = {
     'telemt': 'telemt',
     'hysteria': 'amnezia-hysteria',
     'naiveproxy': 'amnezia-naiveproxy',
+    'mieru': 'mita',
     'dns': 'amnezia-dns',
     'wireguard': 'amnezia-wireguard',
     'socks5': 'amnezia-socks5proxy',
@@ -4147,6 +4279,35 @@ async def api_container_toggle(request: Request, server_id: int, req: ProtocolRe
         server = data['servers'][server_id]
         ssh = get_ssh(server)
         ssh.connect()
+        base = protocol_base(req.protocol)
+        if base in NON_DOCKER_PROTOCOLS:
+            manager = get_protocol_manager(ssh, req.protocol)
+            is_running = manager.check_container_running(req.protocol)
+            if is_running:
+                manager.stop_service()
+                action = 'stopped'
+            else:
+                manager.start_service()
+                action = 'started'
+            diag = manager.get_container_diagnostics(req.protocol)
+            error = diag.get('error_summary') or ''
+            recent_logs = diag.get('recent_logs') or ''
+            if action == 'started' and not diag.get('running'):
+                ssh.disconnect()
+                return JSONResponse({
+                    'error': error or 'Mieru failed to start',
+                    'action': action,
+                    'container': container,
+                    'recent_logs': recent_logs,
+                }, status_code=400)
+            ssh.disconnect()
+            return {
+                'status': 'success',
+                'action': action,
+                'container': container,
+                'error': error,
+                'recent_logs': recent_logs,
+            }
         # Check current state
         out, _, _ = ssh.run_sudo_command(
             f"docker inspect -f '{{{{.State.Running}}}}' {container} 2>/dev/null"
@@ -4210,6 +4371,20 @@ async def api_container_logs(request: Request, server_id: int, req: ContainerLog
         container = protocol_container_name(req.protocol)
         ssh = get_ssh(server)
         ssh.connect()
+        if protocol_base(req.protocol) in NON_DOCKER_PROTOCOLS:
+            mgr = get_protocol_manager(ssh, req.protocol)
+            logs = mgr.get_logs(req.protocol, tail=req.tail or 200)
+            diag = mgr.get_container_diagnostics(req.protocol)
+            ssh.disconnect()
+            return {
+                'status': 'success',
+                'protocol': req.protocol,
+                'container': container,
+                'logs': logs,
+                'running': bool(diag.get('running')),
+                'error': diag.get('error_summary') or '',
+                'container_status': diag.get('status') or '',
+            }
         if protocol_base(req.protocol) == 'hysteria':
             from managers.hysteria_manager import HysteriaManager
             mgr = HysteriaManager(ssh, req.protocol)
@@ -4275,6 +4450,17 @@ async def api_container_logs_stream(request: Request, server_id: int, protocol:
                     ssh = get_ssh(server)
                     ssh.connect()
                     try:
+                        if protocol_base(protocol) in NON_DOCKER_PROTOCOLS:
+                            mgr = get_protocol_manager(ssh, protocol)
+                            logs = mgr.get_logs(protocol, tail=tail)
+                            diag = mgr.get_container_diagnostics(protocol)
+                            state = '|'.join([
+                                diag.get('status') or '',
+                                'true' if diag.get('running') else 'false',
+                                '',
+                                diag.get('error_summary') or '',
+                            ])
+                            return logs, state
                         out, err, _ = ssh.run_sudo_command(
                             f"docker logs --tail {tail} --timestamps {shlex.quote(container)} 2>&1",
                             timeout=25,
@@ -6072,6 +6258,18 @@ async def api_my_connection_config(request: Request, connection_id: str):
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+@app.get('/support', response_class=HTMLResponse, tags=["System Templates"])
+async def support_page(request: Request):
+    user = get_current_user(request)
+    if not user:
+        return RedirectResponse('/login', status_code=302)
+    data = load_data()
+    donate = dict((data.get('settings') or {}).get('donate') or {})
+    if not donate.get('enabled', True):
+        return RedirectResponse('/my', status_code=302)
+    return tpl(request, 'support.html', donate=donate)
+
+
 @app.get('/settings', response_class=HTMLResponse, tags=["System Templates"])
 async def settings_page(request: Request):
     user = _check_admin(request)
@@ -6381,6 +6579,7 @@ async def save_settings(request: Request, payload: SaveSettingsRequest):
     else:
         guest['password_hash'] = existing_guest.get('password_hash')
     data['settings']['guest'] = guest
+    data['settings']['donate'] = payload.donate.dict()
 
     save_data(data)
     logger.info("Settings saved (including captcha and telegram)")

db/backup.py

@@ -3,15 +3,23 @@
 from __future__ import annotations
 
 import logging
+import os
 import subprocess
 from datetime import datetime, timezone
 
-from .connection import get_database_url
+from .connection import get_pg_connection_params
 from .store import invalidate_data_cache
 
 logger = logging.getLogger(__name__)
 
 
+def _pg_cli_env(password: str) -> dict[str, str]:
+    env = os.environ.copy()
+    if password:
+        env['PGPASSWORD'] = password
+    return env
+
+
 def backup_filename() -> str:
     stamp = datetime.now(timezone.utc).strftime('%Y-%m-%d_%H%M%S')
     return f'amnezia_panel_backup_{stamp}.sql'
@@ -19,11 +27,14 @@ def backup_filename() -> str:
 
 def export_database_sql() -> bytes:
     """Create a plain SQL dump of the panel PostgreSQL database."""
-    url = get_database_url()
+    params = get_pg_connection_params()
     proc = subprocess.run(
         [
             'pg_dump',
-            '--dbname', url,
+            '-h', params['host'],
+            '-p', params['port'],
+            '-U', params['user'],
+            '-d', params['dbname'],
             '--no-owner',
             '--no-acl',
             '--clean',
@@ -31,6 +42,7 @@ def export_database_sql() -> bytes:
         ],
         capture_output=True,
         check=False,
+        env=_pg_cli_env(params['password']),
     )
     if proc.returncode != 0:
         err = proc.stderr.decode('utf-8', errors='replace').strip()
@@ -44,12 +56,21 @@ def restore_database_sql(data: bytes) -> None:
     """Restore panel data from a plain SQL dump produced by pg_dump."""
     if not data or not data.strip():
         raise ValueError('Empty backup file')
-    url = get_database_url()
+    params = get_pg_connection_params()
     proc = subprocess.run(
-        ['psql', '--dbname', url, '-v', 'ON_ERROR_STOP=1', '-q'],
+        [
+            'psql',
+            '-h', params['host'],
+            '-p', params['port'],
+            '-U', params['user'],
+            '-d', params['dbname'],
+            '-v', 'ON_ERROR_STOP=1',
+            '-q',
+        ],
         input=data,
         capture_output=True,
         check=False,
+        env=_pg_cli_env(params['password']),
     )
     if proc.returncode != 0:
         err = proc.stderr.decode('utf-8', errors='replace').strip()

db/connection.py

@@ -24,6 +24,37 @@ def get_database_url() -> str:
     return os.environ.get('DATABASE_URL', DEFAULT_DATABASE_URL).strip()
 
 
+def get_pg_connection_params() -> dict[str, str]:
+    """Connection parameters for pg_dump/psql (same source as the app pool)."""
+    from psycopg.conninfo import conninfo_to_dict
+
+    url = get_database_url()
+    scheme, _, rest = url.partition('://')
+    if scheme.startswith('postgresql'):
+        url = f'postgresql://{rest}'
+
+    info = conninfo_to_dict(url)
+    params = {
+        'host': str(info.get('host') or 'localhost'),
+        'port': str(info.get('port') or '5432'),
+        'user': str(info.get('user') or 'amnezia'),
+        'password': str(info.get('password') or ''),
+        'dbname': str(info.get('dbname') or 'amnezia_panel'),
+    }
+
+    # Prefer discrete env vars when set (Dokploy / compose); avoids URL encoding issues.
+    if os.environ.get('POSTGRES_USER', '').strip():
+        params['user'] = os.environ['POSTGRES_USER'].strip()
+    if os.environ.get('POSTGRES_PASSWORD', '').strip():
+        params['password'] = os.environ['POSTGRES_PASSWORD'].strip()
+    if os.environ.get('POSTGRES_DB', '').strip():
+        params['dbname'] = os.environ['POSTGRES_DB'].strip()
+    if os.environ.get('POSTGRES_PORT', '').strip():
+        params['port'] = os.environ['POSTGRES_PORT'].strip()
+
+    return params
+
+
 def get_pool():
     global _pool
     if _pool is not None:

db/store.py

@@ -54,6 +54,13 @@ DEFAULT_SETTINGS = {
         'create_protocol': 'awg',
         'create_server_id': 0,
     },
+    'donate': {
+        'enabled': True,
+        'intro': '',
+        'sbp': {'enabled': True, 'title': '', 'details': ''},
+        'card': {'enabled': True, 'title': '', 'details': ''},
+        'crypto': {'enabled': True, 'title': '', 'details': ''},
+    },
 }
 
 

docker-compose.yml

@@ -33,6 +33,10 @@ services:
       - "${APP_PORT:-5000}:5000"
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER:-amnezia}:${POSTGRES_PASSWORD:-amnezia}@db:5432/${POSTGRES_DB:-amnezia_panel}
+      POSTGRES_USER: ${POSTGRES_USER:-amnezia}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-amnezia}
+      POSTGRES_DB: ${POSTGRES_DB:-amnezia_panel}
+      POSTGRES_PORT: "5432"
       SECRET_KEY: ${SECRET_KEY:-}
       APP_PORT: "5000"
       PORT: "5000"

managers/backup_manager.py

@@ -70,6 +70,9 @@ class BackupManager:
             remote_dir = inst_path('/opt/amnezia/naiveproxy')
             paths['host'] = [remote_dir]
             paths['container'] = ['/etc/caddy']
+        elif base == 'mieru':
+            remote_dir = inst_path('/opt/amnezia/mieru')
+            paths['host'] = [remote_dir]
         elif base == 'dns':
             paths['host'] = ['/opt/amnezia/dns']
             paths['container'] = ['/opt/amnezia/dns']

managers/mieru_manager.py

@@ -0,0 +1,723 @@
+"""
+Mieru protocol manager — native mita server package (systemd).
+
+Installs pinned release from https://github.com/enfein/mieru
+Server binary: mita (systemd service), client: mieru.
+Share links: mierus://user:pass@host?port=...&protocol=TCP&profile=default
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+import secrets
+import shlex
+import string
+import time
+from urllib.parse import quote
+
+logger = logging.getLogger(__name__)
+
+MIERU_RELEASE = '3.28.0'
+GITHUB_RELEASE = f'https://github.com/enfein/mieru/releases/download/v{MIERU_RELEASE}'
+# Official mita UDS (v3.x). Older docs sometimes mention /var/run/mita.sock.
+MITA_SOCK = '/var/run/mita/mita.sock'
+MITA_SOCK_LEGACY = '/var/run/mita.sock'
+# Official package persists applied config here. If this file has portBindings
+# but no users, `mita run` (systemd) auto-starts the proxy and FATAL-exits
+# with "socks5 server listening failed: no user found", crashing the daemon.
+MITA_CONFIG_PB = '/etc/mita/server.conf.pb'
+MITA_CONFIG_JSON = '/etc/mita/server.conf.json'
+
+
+def _q(value):
+    return shlex.quote(str(value))
+
+
+def _rand_token(length=16):
+    alphabet = string.ascii_lowercase + string.digits
+    return ''.join(secrets.choice(alphabet) for _ in range(length))
+
+
+def _sanitize_username(name):
+    base = re.sub(r'[^a-zA-Z0-9_-]', '', (name or 'user').strip())[:24] or 'user'
+    return f'{base}_{_rand_token(4)}'
+
+
+class MieruManager:
+    PROTOCOL = 'mieru'
+    SERVICE_NAME = 'mita'
+    BASE_DIR = '/opt/amnezia/mieru'
+    DEFAULT_PORT = 2999
+
+    def __init__(self, ssh, protocol='mieru'):
+        self.ssh = ssh
+        self.protocol = protocol or self.PROTOCOL
+        self.base_dir = self.BASE_DIR
+        self.clients_path = f'{self.base_dir}/clients.json'
+        self.meta_path = f'{self.base_dir}/metadata.json'
+        self.config_path = f'{self.base_dir}/server_config.json'
+
+    # ===================== STATUS =====================
+
+    def check_docker_installed(self):
+        return True
+
+    def _mita_installed(self):
+        out, _, code = self.ssh.run_command('command -v mita 2>/dev/null')
+        return code == 0 and bool(out.strip())
+
+    def check_protocol_installed(self, protocol_type=None):
+        return self._mita_installed() and self._panel_installed()
+
+    def _panel_installed(self):
+        out, _, code = self.ssh.run_sudo_command(f"test -f {_q(self.meta_path)} && echo yes")
+        return code == 0 and 'yes' in out
+
+    def _proxy_running(self):
+        out, _, code = self.ssh.run_sudo_command('mita status 2>/dev/null')
+        if code != 0:
+            return False
+        return 'RUNNING' in (out or '').upper()
+
+    def check_container_running(self, protocol_type=None):
+        return self._proxy_running()
+
+    def get_logs(self, protocol_type=None, tail=200):
+        tail = max(20, min(int(tail or 200), 2000))
+        out, err, code = self.ssh.run_sudo_command(
+            f"journalctl -u {self.SERVICE_NAME} -n {tail} --no-pager 2>&1",
+            timeout=30,
+        )
+        text = (out or err or '').strip()
+        if not text:
+            status, _, _ = self.ssh.run_sudo_command('mita status 2>&1')
+            text = (status or '').strip()
+        if not text:
+            text = f'(no logs: exit {code})'
+        return text
+
+    def get_container_diagnostics(self, protocol_type=None):
+        running = self._proxy_running()
+        out, _, _ = self.ssh.run_sudo_command(
+            f"systemctl is-active {self.SERVICE_NAME} 2>/dev/null"
+        )
+        daemon_active = (out or '').strip() == 'active'
+        diag = {
+            'status': 'running' if running else ('idle' if daemon_active else 'stopped'),
+            'running': running,
+            'error_summary': '',
+            'recent_logs': self.get_logs(protocol_type, tail=40),
+        }
+        if not self._mita_installed():
+            diag['status'] = 'missing'
+            diag['error_summary'] = 'mita package not installed'
+        elif not running and daemon_active:
+            status_out, _, _ = self.ssh.run_sudo_command('mita status 2>&1')
+            if 'IDLE' in (status_out or '').upper():
+                diag['error_summary'] = 'Proxy stopped (mita status IDLE)'
+            elif status_out.strip():
+                diag['error_summary'] = status_out.strip().splitlines()[-1][:160]
+        elif not daemon_active:
+            diag['error_summary'] = f'{self.SERVICE_NAME} systemd service is not active'
+        return diag
+
+    def get_server_status(self, protocol_type=None):
+        protocol_type = protocol_type or self.protocol
+        exists = self.check_protocol_installed(protocol_type)
+        running = self.check_container_running(protocol_type) if exists else False
+        meta = self._read_metadata() if exists else {}
+        clients = self._read_clients() if exists else []
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        return {
+            'container_exists': exists,
+            'container_running': running,
+            'port': port,
+            'release': meta.get('release') or MIERU_RELEASE,
+            'clients_count': len(clients),
+            'protocol': protocol_type,
+            'base_protocol': self.PROTOCOL,
+            'instance': 1,
+            'container_name': self.SERVICE_NAME,
+        }
+
+    # ===================== IO HELPERS =====================
+
+    def _read_file(self, path):
+        out, _, code = self.ssh.run_sudo_command(f"cat {_q(path)} 2>/dev/null")
+        return out if code == 0 else ''
+
+    def _write_file(self, path, content):
+        import base64
+        b64 = base64.b64encode((content or '').encode('utf-8')).decode('ascii')
+        script = (
+            f"mkdir -p $(dirname {_q(path)}) && "
+            f"echo {_q(b64)} | base64 -d > {_q(path)} && "
+            f"chmod 644 {_q(path)}"
+        )
+        out, err, code = self.ssh.run_sudo_command(f"sh -c {_q(script)}", timeout=30)
+        if code != 0:
+            raise RuntimeError(f'Failed to write {path}: {err or out}')
+
+    def _read_metadata(self):
+        raw = self._read_file(self.meta_path).strip()
+        if not raw:
+            return {}
+        try:
+            data = json.loads(raw)
+            return data if isinstance(data, dict) else {}
+        except Exception:
+            return {}
+
+    def _write_metadata(self, meta):
+        self._write_file(self.meta_path, json.dumps(meta, indent=2))
+
+    def _read_clients(self):
+        raw = self._read_file(self.clients_path).strip()
+        if not raw:
+            return []
+        try:
+            data = json.loads(raw)
+            return data if isinstance(data, list) else []
+        except Exception:
+            return []
+
+    def _write_clients(self, clients):
+        self._write_file(self.clients_path, json.dumps(clients, indent=2))
+
+    def _make_bootstrap_client(self):
+        return {
+            'id': secrets.token_hex(8),
+            'name': 'panel-bootstrap',
+            'username': f'panel_{_rand_token(6)}',
+            'password': _rand_token(20),
+            'enabled': True,
+            'bootstrap': True,
+        }
+
+    def _ensure_bootstrap_clients(self, clients):
+        """Guarantee at least one enabled user so mita never starts with empty users."""
+        clients = [c for c in (clients or []) if isinstance(c, dict)]
+        enabled = [
+            c for c in clients
+            if c.get('enabled', True)
+            and (c.get('username') or c.get('name') or c.get('id'))
+            and (c.get('password') or '').strip()
+        ]
+        if enabled:
+            return clients
+        bootstrap = next((c for c in clients if c.get('bootstrap')), None)
+        if bootstrap:
+            bootstrap['enabled'] = True
+            if not (bootstrap.get('password') or '').strip():
+                bootstrap['password'] = _rand_token(20)
+            if not (bootstrap.get('username') or '').strip():
+                bootstrap['username'] = f'panel_{_rand_token(6)}'
+            return clients
+        clients.append(self._make_bootstrap_client())
+        return clients
+
+    def _daemon_needs_heal(self):
+        failed, _, _ = self.ssh.run_sudo_command(
+            f"systemctl is-failed {self.SERVICE_NAME} 2>/dev/null"
+        )
+        if (failed or '').strip() == 'failed':
+            return True
+        active, _, _ = self.ssh.run_sudo_command(
+            f"systemctl is-active {self.SERVICE_NAME} 2>/dev/null"
+        )
+        # Daemon is up — ignore historical journal lines from earlier crashes.
+        if (active or '').strip() == 'active':
+            return False
+        journal, _, _ = self.ssh.run_sudo_command(
+            f"journalctl -u {self.SERVICE_NAME} -n 30 --no-pager --since '10 min ago' 2>&1",
+            timeout=30,
+        )
+        return 'no user found' in (journal or '').lower()
+
+    def _heal_mita_store(self, log=None):
+        """Break the systemd crash loop caused by empty users in server.conf.pb.
+
+        `mita run` auto-starts the proxy when portBindings exist; with zero users
+        it FATAL-exits and never keeps the RPC socket up for `mita apply`.
+        Wiping the store lets the daemon stay IDLE so we can re-apply a valid config.
+        """
+        if log is not None:
+            log.append('healing mita store (empty users / crash loop)')
+        self.ssh.run_sudo_command(
+            f"systemctl stop {self.SERVICE_NAME} 2>/dev/null || true; "
+            f"systemctl reset-failed {self.SERVICE_NAME} 2>/dev/null || true; "
+            f"rm -f {_q(MITA_SOCK)} {_q(MITA_SOCK_LEGACY)} /var/run/mita/*.sock "
+            f"{_q(MITA_CONFIG_PB)} {_q(MITA_CONFIG_JSON)} 2>/dev/null || true; "
+            f"mkdir -p /var/run/mita /etc/mita 2>/dev/null || true",
+            timeout=60,
+        )
+        # systemd StartLimitBurst: wait out "Start request repeated too quickly".
+        time.sleep(6)
+
+        clients = self._ensure_bootstrap_clients(self._read_clients())
+        self._write_clients(clients)
+        meta = self._read_metadata()
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        config = self._build_server_config(port, clients)
+        self._write_file(self.config_path, json.dumps(config, indent=2))
+
+        self.ssh.run_sudo_command(
+            f"systemctl reset-failed {self.SERVICE_NAME} 2>/dev/null || true; "
+            f"systemctl start {self.SERVICE_NAME}",
+            timeout=60,
+        )
+        if not self._wait_for_rpc(timeout=60):
+            # Second attempt after another rate-limit window.
+            self.ssh.run_sudo_command(
+                f"systemctl reset-failed {self.SERVICE_NAME} 2>/dev/null || true; "
+                f"systemctl restart {self.SERVICE_NAME}",
+                timeout=60,
+            )
+            time.sleep(3)
+            if not self._wait_for_rpc(timeout=45):
+                journal, _, _ = self.ssh.run_sudo_command(
+                    f"journalctl -u {self.SERVICE_NAME} -n 50 --no-pager 2>&1",
+                    timeout=30,
+                )
+                raise RuntimeError(
+                    'mita daemon still not ready after heal. '
+                    f'journal: {(journal or "").strip()[-600:]}'
+                )
+        out, err, code = self._mita_cli(
+            ['apply', 'config', _q(self.config_path)],
+            timeout=60,
+        )
+        if code != 0:
+            raise RuntimeError(
+                f'mita apply after heal failed: {(err or out or "").strip()}'
+            )
+        if log is not None:
+            log.append('mita config re-applied with bootstrap user')
+
+    def _ensure_daemon(self, log=None):
+        """Ensure mita systemd unit is up and RPC socket answers."""
+        self.ssh.run_sudo_command(
+            f"systemctl enable {self.SERVICE_NAME} 2>/dev/null || true; "
+            f"mkdir -p /var/run/mita /etc/mita 2>/dev/null || true",
+            timeout=30,
+        )
+        # Official package expects the operating user in group `mita`.
+        user_out, _, _ = self.ssh.run_command('id -un 2>/dev/null || echo root')
+        op_user = (user_out or 'root').strip() or 'root'
+        if op_user != 'root':
+            self.ssh.run_sudo_command(
+                f"usermod -a -G mita {_q(op_user)} 2>/dev/null || true",
+                timeout=15,
+            )
+
+        if self._daemon_needs_heal():
+            self._heal_mita_store(log)
+            if log is not None:
+                log.append('mita daemon is active')
+            return
+
+        self.ssh.run_sudo_command(
+            f"systemctl start {self.SERVICE_NAME} 2>/dev/null || "
+            f"systemctl restart {self.SERVICE_NAME} 2>/dev/null || true",
+            timeout=60,
+        )
+        if not self._wait_for_rpc(timeout=45):
+            # Crash loop / wrong socket / rate-limit — wipe store and recover.
+            self._heal_mita_store(log)
+        if log is not None:
+            log.append('mita daemon is active')
+
+    def _wait_for_rpc(self, timeout=30):
+        deadline = time.time() + timeout
+        sock_check = (
+            f"(test -S {_q(MITA_SOCK)} || test -S {_q(MITA_SOCK_LEGACY)}) && echo ok"
+        )
+        while time.time() < deadline:
+            # Prefer CLI status: if it answers IDLE/RUNNING, RPC is up
+            # regardless of which sock path we expected.
+            status_out, _, status_code = self.ssh.run_sudo_command(
+                'mita status 2>&1',
+                timeout=20,
+            )
+            text = (status_out or '').upper()
+            if status_code == 0 and ('IDLE' in text or 'RUNNING' in text):
+                return True
+            sock_out, _, sock_code = self.ssh.run_sudo_command(sock_check)
+            if sock_code == 0 and 'ok' in (sock_out or ''):
+                time.sleep(1)
+                continue
+            time.sleep(1.5)
+        return False
+
+    def _mita_cli(self, args, timeout=60):
+        """Run mita CLI as root so group/socket ACL is not an issue."""
+        cmd = f"mita {' '.join(args)} 2>&1"
+        return self.ssh.run_sudo_command(cmd, timeout=timeout)
+
+    def _build_server_config(self, port, clients):
+        clients = self._ensure_bootstrap_clients(clients)
+        users = []
+        for c in clients:
+            if not c.get('enabled', True):
+                continue
+            username = (c.get('username') or c.get('name') or c.get('id') or '').strip()
+            password = (c.get('password') or '').strip()
+            if not username or not password:
+                continue
+            users.append({'name': username, 'password': password})
+        # mita FATAL-exits on empty users during proxy start ("no user found").
+        if not users:
+            bootstrap = self._make_bootstrap_client()
+            users = [{'name': bootstrap['username'], 'password': bootstrap['password']}]
+        return {
+            'portBindings': [{'port': int(port), 'protocol': 'TCP'}],
+            'users': users,
+            'loggingLevel': 'INFO',
+            'mtu': 1400,
+        }
+
+    def _apply_config(self, config, reload_only=False):
+        self._ensure_daemon()
+        self._write_file(self.config_path, json.dumps(config, indent=2))
+        out, err, code = self._mita_cli(
+            ['apply', 'config', _q(self.config_path)],
+            timeout=60,
+        )
+        if code != 0:
+            # Recover from transient EOF / unavailable RPC.
+            if self._is_rpc_error(out, err):
+                self._ensure_daemon()
+                out, err, code = self._mita_cli(
+                    ['apply', 'config', _q(self.config_path)],
+                    timeout=60,
+                )
+            if code != 0:
+                raise RuntimeError((err or out or 'mita apply config failed').strip())
+
+        if reload_only:
+            # users/loggingLevel can hot-reload; fall back to full restart.
+            reload_out, reload_err, reload_code = self._mita_cli(['reload'], timeout=30)
+            if reload_code == 0:
+                return
+            logger.info('mita reload failed, falling back to stop/start: %s',
+                        (reload_err or reload_out or '').strip())
+
+        self._restart_proxy()
+
+    def _is_rpc_error(self, *parts):
+        text = ' '.join(str(p or '') for p in parts).lower()
+        return any(token in text for token in (
+            'rpc error',
+            'unavailable',
+            'error reading from server',
+            'eof',
+            'no such file or directory',
+            'mita.sock',
+            'connection refused',
+        ))
+
+    def _restart_proxy(self):
+        # Always push a config that includes users before start — recovers hosts
+        # whose /etc/mita/server.conf.pb lost the users list.
+        try:
+            meta = self._read_metadata()
+            port = int(meta.get('port') or self.DEFAULT_PORT)
+            clients = self._ensure_bootstrap_clients(self._read_clients())
+            self._write_clients(clients)
+            config = self._build_server_config(port, clients)
+            self._write_file(self.config_path, json.dumps(config, indent=2))
+            apply_out, apply_err, apply_code = self._mita_cli(
+                ['apply', 'config', _q(self.config_path)],
+                timeout=60,
+            )
+            if apply_code != 0 and self._is_rpc_error(apply_out, apply_err):
+                self._heal_mita_store()
+            elif apply_code != 0:
+                logger.warning(
+                    'mita apply before start failed: %s',
+                    (apply_err or apply_out or '').strip(),
+                )
+        except Exception as e:
+            logger.warning('pre-start config sync failed: %s', e)
+
+        self._mita_cli(['stop'], timeout=30)
+        time.sleep(1)
+        last_err = ''
+        for attempt in range(1, 4):
+            out, err, code = self._mita_cli(['start'], timeout=60)
+            if code == 0:
+                time.sleep(1)
+                if self._proxy_running():
+                    return
+                last_err = (out or err or 'mita start returned ok but status is not RUNNING').strip()
+            else:
+                last_err = (err or out or 'mita start failed').strip()
+            if 'no user found' in last_err.lower() or self._daemon_needs_heal():
+                self._heal_mita_store()
+                continue
+            if self._is_rpc_error(last_err) or attempt < 3:
+                self.ssh.run_sudo_command(
+                    f"systemctl restart {self.SERVICE_NAME} 2>/dev/null || true",
+                    timeout=60,
+                )
+                if not self._wait_for_rpc(timeout=30):
+                    self._heal_mita_store()
+                time.sleep(1)
+                continue
+            break
+        journal, _, _ = self.ssh.run_sudo_command(
+            f"journalctl -u {self.SERVICE_NAME} -n 30 --no-pager 2>&1",
+            timeout=30,
+        )
+        raise RuntimeError(
+            f'{last_err}. journal: {(journal or "").strip()[-400:]}'
+        )
+
+    def _sync_server(self, reload_only=True):
+        meta = self._read_metadata()
+        port = int(meta.get('port') or self.DEFAULT_PORT)
+        clients = self._ensure_bootstrap_clients(self._read_clients())
+        self._write_clients(clients)
+        config = self._build_server_config(port, clients)
+        self._apply_config(config, reload_only=reload_only)
+
+    def _open_firewall_port(self, port):
+        script = f"""
+PORT={int(port)}
+if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qi active; then
+  ufw allow "$PORT"/tcp || true
+fi
+if command -v firewall-cmd >/dev/null 2>&1; then
+  firewall-cmd --permanent --add-port="$PORT"/tcp 2>/dev/null || true
+  firewall-cmd --reload 2>/dev/null || true
+fi
+"""
+        self.ssh.run_sudo_script(script, timeout=60)
+
+    def _package_url(self):
+        arch_out, _, _ = self.ssh.run_command('uname -m')
+        arch = (arch_out or '').strip().lower()
+        _, _, deb_code = self.ssh.run_command('command -v dpkg 2>/dev/null')
+        _, _, rpm_code = self.ssh.run_command('command -v rpm 2>/dev/null')
+        use_deb = deb_code == 0 or rpm_code != 0
+        if use_deb:
+            if arch in ('aarch64', 'arm64'):
+                return f'{GITHUB_RELEASE}/mita_{MIERU_RELEASE}_arm64.deb', 'deb'
+            return f'{GITHUB_RELEASE}/mita_{MIERU_RELEASE}_amd64.deb', 'deb'
+        if arch in ('aarch64', 'arm64'):
+            return f'{GITHUB_RELEASE}/mita-{MIERU_RELEASE}-1.aarch64.rpm', 'rpm'
+        return f'{GITHUB_RELEASE}/mita-{MIERU_RELEASE}-1.x86_64.rpm', 'rpm'
+
+    def _install_package(self, log):
+        url, pkg_type = self._package_url()
+        tmp = f'/tmp/mita_{MIERU_RELEASE}'
+        if pkg_type == 'deb':
+            tmp += '.deb'
+            install_cmd = f"dpkg -i {_q(tmp)} || apt-get install -f -y"
+        else:
+            tmp += '.rpm'
+            install_cmd = f"rpm -Uvh --force {_q(tmp)}"
+        out, err, code = self.ssh.run_sudo_command(
+            f"curl -fL {_q(url)} -o {_q(tmp)} 2>&1",
+            timeout=300,
+        )
+        if code != 0:
+            raise RuntimeError(f'Failed to download mita package: {err or out}')
+        log.append(f'Downloaded mita v{MIERU_RELEASE}')
+        out, err, code = self.ssh.run_sudo_command(install_cmd, timeout=180)
+        if code != 0:
+            raise RuntimeError(f'Failed to install mita package: {err or out}')
+        log.append('Installed mita package')
+        self._ensure_daemon(log)
+
+    def _build_share_uri(self, host, port, username, password, name=''):
+        user = quote(username or '', safe='')
+        pw = quote(password or '', safe='')
+        params = f"port={int(port)}&protocol=TCP&profile=default"
+        link = f"mierus://{user}:{pw}@{host}?{params}"
+        if name:
+            link += f"#{quote(name, safe='')}"
+        return link
+
+    def _build_client_json(self, host, port, username, password):
+        return json.dumps({
+            'profiles': [{
+                'profileName': 'default',
+                'user': {'name': username, 'password': password},
+                'servers': [{
+                    'ipAddress': host,
+                    'domainName': '',
+                    'portBindings': [{'port': int(port), 'protocol': 'TCP'}],
+                }],
+                'mtu': 1400,
+                'multiplexing': {'level': 'MULTIPLEXING_LOW'},
+                'handshakeMode': 'HANDSHAKE_STANDARD',
+            }],
+            'activeProfile': 'default',
+            'rpcPort': 8964,
+            'socks5Port': 1080,
+            'loggingLevel': 'INFO',
+            'socks5ListenLAN': False,
+        }, indent=2)
+
+    # ===================== INSTALL / REMOVE =====================
+
+    def install_protocol(self, protocol_type=None, port=None):
+        protocol_type = protocol_type or self.protocol
+        port = int(port or self.DEFAULT_PORT)
+        if port < 1025 or port > 65535:
+            return {'status': 'error', 'message': 'Port must be between 1025 and 65535'}
+
+        log = []
+        try:
+            if not self._mita_installed():
+                self._install_package(log)
+            else:
+                log.append(f'mita already installed, configuring panel (v{MIERU_RELEASE})')
+                self._ensure_daemon(log)
+
+            self.ssh.run_sudo_command(f"mkdir -p {_q(self.base_dir)}")
+            meta = {'port': port, 'release': MIERU_RELEASE}
+            self._write_metadata(meta)
+            bootstrap = self._make_bootstrap_client()
+            self._write_clients([bootstrap])
+            log.append(f'Prepared {self.base_dir}')
+
+            config = self._build_server_config(port, [bootstrap])
+            self._apply_config(config, reload_only=False)
+            self._open_firewall_port(port)
+            log.append(f'Started mita proxy on TCP {port}')
+            return {
+                'status': 'success',
+                'message': f'Mieru v{MIERU_RELEASE} installed',
+                'log': log,
+                'port': str(port),
+                'release': MIERU_RELEASE,
+            }
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'log': log}
+
+    def remove_container(self, protocol_type=None):
+        self.ssh.run_sudo_command('mita stop 2>/dev/null || true', timeout=30)
+        self.ssh.run_sudo_command(f"rm -rf {_q(self.base_dir)}")
+        return True
+
+    def start_service(self):
+        self._ensure_daemon()
+        # Re-apply panel clients (with bootstrap) then start — fixes empty-users store.
+        self._sync_server(reload_only=False)
+
+    def stop_service(self):
+        self.ssh.run_sudo_command('mita stop 2>/dev/null || true', timeout=30)
+
+    def get_server_config(self, protocol_type=None):
+        out, _, code = self.ssh.run_sudo_command('mita describe config 2>/dev/null')
+        if code == 0 and (out or '').strip():
+            return out
+        return self._read_file(self.config_path)
+
+    def save_server_config(self, protocol_type=None, config_text=''):
+        raw = (config_text or '').strip()
+        if not raw:
+            raise RuntimeError('Config is empty')
+        try:
+            parsed = json.loads(raw)
+        except Exception as e:
+            raise RuntimeError(f'Invalid JSON config: {e}') from e
+        if not isinstance(parsed, dict):
+            raise RuntimeError('Config must be a JSON object')
+        users = parsed.get('users')
+        if not isinstance(users, list) or not any(
+            isinstance(u, dict) and (u.get('name') or '').strip()
+            and ((u.get('password') or '').strip() or (u.get('hashedPassword') or '').strip())
+            for u in users
+        ):
+            bootstrap = self._make_bootstrap_client()
+            parsed['users'] = [{
+                'name': bootstrap['username'],
+                'password': bootstrap['password'],
+            }]
+            clients = self._ensure_bootstrap_clients(self._read_clients())
+            self._write_clients(clients)
+        self._apply_config(parsed, reload_only=False)
+        return True
+
+    # ===================== CLIENTS =====================
+
+    def get_clients(self, protocol_type=None):
+        clients = self._read_clients()
+        result = []
+        for c in clients:
+            if c.get('bootstrap'):
+                continue
+            cname = c.get('name') or c.get('id')
+            result.append({
+                'clientId': c.get('id'),
+                'client_id': c.get('id'),
+                'id': c.get('id'),
+                'name': cname,
+                'email': cname,
+                'enabled': c.get('enabled', True),
+                'userData': {'clientName': cname, 'enabled': c.get('enabled', True)},
+            })
+        return result
+
+    def add_client(self, protocol_type, name, host, port=None):
+        meta = self._read_metadata()
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        client_id = secrets.token_hex(8)
+        username = _sanitize_username(name)
+        password = _rand_token(20)
+        clients = self._read_clients()
+        clients.append({
+            'id': client_id,
+            'name': name or username,
+            'username': username,
+            'password': password,
+            'enabled': True,
+        })
+        self._write_clients(clients)
+        self._sync_server(reload_only=True)
+        config = self._build_share_uri(host, port, username, password, name or username)
+        json_config = self._build_client_json(host, port, username, password)
+        return {
+            'clientId': client_id,
+            'client_id': client_id,
+            'id': client_id,
+            'name': name or username,
+            'config': config,
+            'json_config': json_config,
+        }
+
+    def get_client_config(self, protocol_type, client_id, host, port=None):
+        meta = self._read_metadata()
+        port = int(port or meta.get('port') or self.DEFAULT_PORT)
+        clients = self._read_clients()
+        client = next((c for c in clients if c.get('id') == client_id), None)
+        if not client or client.get('bootstrap'):
+            return ''
+        if not client.get('enabled', True):
+            return ''
+        username = client.get('username') or client.get('name') or client_id
+        password = client.get('password') or ''
+        name = client.get('name') or username
+        return self._build_share_uri(host, port, username, password, name)
+
+    def remove_client(self, protocol_type, client_id):
+        clients = [c for c in self._read_clients() if c.get('id') != client_id]
+        clients = self._ensure_bootstrap_clients(clients)
+        self._write_clients(clients)
+        self._sync_server(reload_only=True)
+        return True
+
+    def toggle_client(self, protocol_type, client_id, enabled):
+        clients = self._read_clients()
+        for c in clients:
+            if c.get('id') == client_id:
+                c['enabled'] = bool(enabled)
+        clients = self._ensure_bootstrap_clients(clients)
+        self._write_clients(clients)
+        self._sync_server(reload_only=True)
+        return True

static/css/style.css

@@ -949,6 +949,11 @@ a:hover {
     color: #38bdf8;
 }
 
+.protocol-mieru .protocol-icon {
+    background: linear-gradient(135deg, rgba(99, 102, 241, 0.2), rgba(168, 85, 247, 0.1));
+    color: #818cf8;
+}
+
 .protocol-dns .protocol-icon {
     background: linear-gradient(135deg, rgba(34, 197, 94, 0.2), rgba(16, 185, 129, 0.1));
     color: var(--success);
@@ -2207,6 +2212,15 @@ a:hover {
     font-weight: 600;
 }
 
+.nav-link-support {
+    opacity: 0.85;
+}
+
+.nav-link-support:hover {
+    opacity: 1;
+    color: #f472b6;
+}
+
 .nav-user {
     display: flex;
     align-items: center;

static/icons.svg

@@ -108,4 +108,7 @@
   <symbol id="layers" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round">
     <path d="m12.83 2.18a2 2 0 0 0-1.66 0L2.6 6.08a1 1 0 0 0 0 1.83l8.58 3.91a2 2 0 0 0 1.66 0l8.58-3.9a1 1 0 0 0 0-1.83Z"/><path d="m22 17.65-9.17 4.16a2 2 0 0 1-1.66 0L2 17.65"/><path d="m22 12.65-9.17 4.16a2 2 0 0 1-1.66 0L2 12.65"/>
   </symbol>
+  <symbol id="heart" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M19 14c1.49-1.46 3-3.21 3-5.5A5.5 5.5 0 0 0 16.5 3c-1.76 0-3 .5-4.5 2-1.5-1.5-2.74-2-4.5-2A5.5 5.5 0 0 0 2 8.5c0 2.29 1.51 4.04 3 5.5l7 7Z"/>
+  </symbol>
 </svg>

telegram_bot.py

@@ -24,7 +24,7 @@ _bot_task: Optional[asyncio.Task] = None
 _callback_refs = {}
 _pending_inputs = {}
 
-CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "hysteria", "naiveproxy", "wireguard"}
+CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "hysteria", "naiveproxy", "mieru", "wireguard"}
 SERVICE_PROTOCOLS = {"dns", "adguard", "socks5", "nginx"}
 
 
@@ -139,6 +139,7 @@ def _protocol_display_name(protocol: str) -> str:
         "telemt": "Telemt",
         "hysteria": "Hysteria 2",
         "naiveproxy": "NaiveProxy",
+        "mieru": "Mieru",
         "dns": "AmneziaDNS",
         "wireguard": "WireGuard",
         "socks5": "SOCKS5",
@@ -342,6 +343,7 @@ def _get_ssh_and_manager(server: dict, proto: str):
     from managers.telemt_manager import TelemtManager
     from managers.hysteria_manager import HysteriaManager
     from managers.naiveproxy_manager import NaiveProxyManager
+    from managers.mieru_manager import MieruManager
     from managers.wireguard_manager import WireGuardManager
     from managers.dns_manager import DNSManager
     from managers.socks5_manager import Socks5Manager
@@ -364,6 +366,8 @@ def _get_ssh_and_manager(server: dict, proto: str):
         manager = HysteriaManager(ssh, proto)
     elif base == "naiveproxy":
         manager = NaiveProxyManager(ssh, proto)
+    elif base == "mieru":
+        manager = MieruManager(ssh, proto)
     elif base == "wireguard":
         manager = WireGuardManager(ssh)
     elif base == "dns":
@@ -569,7 +573,7 @@ async def _send_config_by_client(api: TelegramAPI, chat_id: int, server: dict, p
         server_name = server.get("name") or server.get("host", "Unknown")
         await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server_name)}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
 
-        is_link_proto = _proto_base(proto) in ("xray", "telemt", "hysteria", "naiveproxy")
+        is_link_proto = _proto_base(proto) in ("xray", "telemt", "hysteria", "naiveproxy", "mieru")
         if is_link_proto:
             await api.send_message(chat_id, f"🔗 <b>Connection link</b> (tap to copy):\n<code>{_e(config)}</code>")
         else:
@@ -926,7 +930,7 @@ async def _admin_create_client(api: TelegramAPI, chat_id: int, message_id: int,
 
 async def _send_config_text(api: TelegramAPI, chat_id: int, server: dict, proto: str, conn_name: str, config: str, generate_vpn_link_fn: Callable):
     await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server.get('name') or server.get('host'))}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
-    if _proto_base(proto) in ("xray", "telemt", "hysteria", "naiveproxy"):
+    if _proto_base(proto) in ("xray", "telemt", "hysteria", "naiveproxy", "mieru"):
         await api.send_message(chat_id, f"🔗 <b>Connection link</b>:\n<code>{_e(config)}</code>")
     else:
         await api.send_message(chat_id, f"<b>📄 Configuration:</b>\n<pre>{_e(config)}</pre>")

templates/base.html

@@ -52,6 +52,9 @@
                 <a href="/settings" class="nav-link">{{ icon('settings') }} {{ _('nav_settings') }}</a>
                 {% endif %}
                 <a href="/my" class="nav-link">{{ icon('layers') }} {{ _('nav_connections') }}</a>
+                {% if donate_enabled %}
+                <a href="/support" class="nav-link nav-link-support">{{ icon('heart') }} {{ _('nav_support') }}</a>
+                {% endif %}
             </nav>
 
             <div class="nav-user">

templates/guest.html

@@ -107,6 +107,7 @@
         if (p === 'xui') return '3x-ui VLESS';
         if (p === 'hysteria') return 'Hysteria 2';
         if (p === 'naiveproxy') return 'NaiveProxy';
+        if (p === 'mieru') return 'Mieru';
         if (p === 'telemt') return 'Telemt';
         return (p || '').toUpperCase();
     }

templates/invites.html

@@ -196,7 +196,7 @@
     const xuiConfigured = {{ 'true' if xui_configured else 'false' }};
     const xuiDefaultInbound = {{ xui_default_inbound | int }};
     const xuiDefaultPanelId = {{ (xui_default_panel_id or '') | tojson }};
-    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy'];
+    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'mieru'];
     const PROTO_TITLES = {
         awg2: 'AmneziaWG 2.0',
         awg: 'AmneziaWG',
@@ -206,6 +206,7 @@
         telemt: 'Telemt',
         hysteria: 'Hysteria 2',
         naiveproxy: 'NaiveProxy',
+        mieru: 'Mieru',
         xui: '3x-ui VLESS',
     };
 

templates/my_connections.html

@@ -122,7 +122,7 @@
                 const vpnTab = document.querySelectorAll('.config-tab')[1];
                 const vpnPanel = document.getElementById('panel-vpn');
                 const base = String(proto || '').split('__')[0];
-                if (proto === 'telemt' || base === 'hysteria' || base === 'naiveproxy') {
+                if (proto === 'telemt' || base === 'hysteria' || base === 'naiveproxy' || base === 'mieru') {
                     vpnTab.style.display = 'none';
                 } else {
                     vpnTab.style.display = '';

templates/server.html

@@ -314,6 +314,31 @@
         </div>
     </div>
 
+    <!-- Mieru Card -->
+    <div class="card card-hover protocol-card protocol-mieru" id="proto-mieru">
+        <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
+            <div class="protocol-icon">{{ icon('zap') }}</div>
+            <div class="flex gap-sm" id="mieru-ctrl" style="display:none!important;"></div>
+        </div>
+        <div class="protocol-name">Mieru <span
+            style="font-size:0.65rem; background:var(--accent, #6366f1); color:#fff; padding:2px 6px; border-radius:8px; vertical-align:middle;">v3.28.0</span></div>
+        <div class="protocol-desc">
+            {{ _('mieru_desc') }}
+        </div>
+        <div class="protocol-status" id="mieru-status">
+            <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
+        </div>
+        <div id="mieru-info" class="hidden">
+            <div class="protocol-info" id="mieru-info-grid"></div>
+        </div>
+        <div class="flex gap-sm" id="mieru-actions">
+            <button class="btn btn-primary btn-sm" onclick="openInstallModal('mieru')" id="mieru-install-btn"
+                style="flex:1">
+                {{ _('install') }}
+            </button>
+        </div>
+    </div>
+
     <!-- Hysteria Card -->
     <div class="card card-hover protocol-card protocol-hysteria" id="proto-hysteria">
         <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
@@ -777,6 +802,20 @@
                 <div class="form-hint" style="margin-top: var(--space-sm); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">{{ _('naiveproxy_client_hint') }}</div>
             </div>
 
+            <div id="mieruOptions"
+                style="display:none; padding: var(--space-md); background: rgba(0,0,0,0.03); border-radius: var(--radius-md); margin-bottom: var(--space-md);">
+                <div class="form-hint" style="margin-bottom: var(--space-md); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35); color: var(--text);">
+                    {{ _('mieru_ports_warning') }}
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('port') }} (TCP) *</label>
+                    <input class="form-input" type="number" id="installMieruPort" value="2999" min="1025" max="65535">
+                    <div class="form-hint">{{ _('mieru_port_hint') }}</div>
+                </div>
+                <div class="form-hint">{{ _('mieru_install_hint') }}</div>
+                <div class="form-hint" style="margin-top: var(--space-sm); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">{{ _('mieru_client_hint') }}</div>
+            </div>
+
             <div class="modal-footer">
                 <button class="btn btn-secondary" onclick="closeModal('installModal')">{{ _('cancel') }}</button>
                 <button class="btn btn-primary" onclick="installProtocol()" id="installBtn">
@@ -1160,6 +1199,7 @@
         { proto: 'awg_legacy', category: 'protocols', icon: 'radio', title: 'AmneziaWG Legacy', descKey: 'awg_legacy_desc' },
         { proto: 'xray', category: 'protocols', icon: 'zap', title: 'Xray (VLESS-Reality)', descKey: 'xray_desc' },
         { proto: 'telemt', category: 'protocols', icon: 'plane', title: 'Telemt (Telegram Proxy)', descKey: 'telemt_desc' },
+        { proto: 'mieru', category: 'protocols', icon: 'zap', title: 'Mieru', descKey: 'mieru_desc', badge: 'v3.28.0' },
         { proto: 'hysteria', category: 'protocols', icon: 'refresh', title: 'Hysteria 2', descKey: 'hysteria_desc' },
         { proto: 'naiveproxy', category: 'protocols', icon: 'link', title: 'NaiveProxy', descKey: 'naiveproxy_desc', badge: 'STABLE' },
         { proto: 'wireguard', category: 'protocols', icon: 'lock', title: 'WireGuard', descKey: 'wireguard_desc' },
@@ -1495,6 +1535,7 @@
             case 'telemt': title = 'Telemt'; break;
             case 'hysteria': title = 'Hysteria 2'; break;
             case 'naiveproxy': title = 'NaiveProxy'; break;
+            case 'mieru': title = 'Mieru'; break;
             case 'wireguard': title = 'WireGuard'; break;
             case 'dns': title = 'AmneziaDNS'; break;
             case 'socks5': title = 'SOCKS5 Proxy'; break;
@@ -1554,7 +1595,7 @@
 
                 for (const [proto, info] of orderedProtocolEntries(data.protocols)) {
                     updateProtocolCard(proto, info);
-                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'wireguard'].includes(protoBase(proto));
+                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'mieru', 'wireguard'].includes(protoBase(proto));
                     if (info.container_running && isVPN) {
                         const opt = document.createElement('option');
                         opt.value = proto;
@@ -1782,7 +1823,7 @@
                 if (isService) {
                     grid = buildServiceInfoGrid(proto, info);
                 } else if (info.port) {
-                    grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('port')}</span><span class="protocol-info-value">${info.port}/${(['xray', 'telemt', 'naiveproxy'].includes(protoBase(proto))) ? 'TCP' : 'UDP'}</span></div>`;
+                    grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('port')}</span><span class="protocol-info-value">${info.port}/${(['xray', 'telemt', 'naiveproxy', 'mieru'].includes(protoBase(proto))) ? 'TCP' : 'UDP'}</span></div>`;
                     if (WG_AWG_BASES.has(protoBase(proto))) {
                         const endpoint = (connectDomainEffective.effective_host && connectDomainEffective.effective_host !== SERVER_HOST)
                             ? connectDomainEffective.effective_host
@@ -1795,6 +1836,9 @@
                     if (protoBase(proto) === 'naiveproxy' && info.domain) {
                         grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('naiveproxy_domain')}</span><span class="protocol-info-value">${info.domain}</span></div>`;
                     }
+                    if (protoBase(proto) === 'mieru' && info.release) {
+                        grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('mieru_version')}</span><span class="protocol-info-value">v${info.release}</span></div>`;
+                    }
                 }
                 if (!isService && info.clients_count !== undefined) {
                     grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('connections')}</span><span class="protocol-info-value">${info.clients_count}</span></div>`;
@@ -1844,6 +1888,13 @@
                     <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
                 `;
                 showConnectionsSection();
+            } else if (protoBase(proto) === 'mieru') {
+                actionsEl.innerHTML = `
+                    <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')">${_('backup')}</button>
+                    <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
+                `;
+                showConnectionsSection();
             } else {
                 actionsEl.innerHTML = `
                     <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
@@ -2247,6 +2298,7 @@
         const nginxOpts = document.getElementById('nginxOptions');
         const hysteriaOpts = document.getElementById('hysteriaOptions');
         const naiveproxyOpts = document.getElementById('naiveproxyOptions');
+        const mieruOpts = document.getElementById('mieruOptions');
 
         telemtOpts.style.display = 'none';
         socks5Opts.style.display = 'none';
@@ -2254,6 +2306,7 @@
         nginxOpts.style.display = 'none';
         hysteriaOpts.style.display = 'none';
         if (naiveproxyOpts) naiveproxyOpts.style.display = 'none';
+        if (mieruOpts) mieruOpts.style.display = 'none';
         if (portGroup) portGroup.style.display = '';
 
         if (base === 'dns') {
@@ -2321,6 +2374,17 @@
             if (npDomain && !npDomain.value && SERVER_SSL_DOMAIN) npDomain.value = SERVER_SSL_DOMAIN;
             if (npEmail && !npEmail.value && SERVER_SSL_EMAIL) npEmail.value = SERVER_SSL_EMAIL;
             updateNaiveproxyDnsHint();
+        } else if (base === 'mieru') {
+            if (portGroup) portGroup.style.display = 'none';
+            const suggested = '2999';
+            portInput.value = suggested;
+            portInput.disabled = false;
+            if (mieruOpts) mieruOpts.style.display = 'block';
+            const miPort = document.getElementById('installMieruPort');
+            if (miPort) {
+                miPort.value = suggested;
+                miPort.oninput = () => { portInput.value = miPort.value; };
+            }
         } else {
             portLabel.textContent = _('port') + ' (UDP)';
             portInput.value = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 55424) : '55424';
@@ -2398,6 +2462,11 @@
                 params.port = '443';
                 params.naiveproxy_domain = document.getElementById('installNaiveproxyDomain').value.trim();
                 params.naiveproxy_email = document.getElementById('installNaiveproxyEmail').value.trim();
+            } else if (protoBase(currentInstallProto) === 'mieru') {
+                const miPortEl = document.getElementById('installMieruPort');
+                if (miPortEl && miPortEl.value) {
+                    params.port = miPortEl.value;
+                }
             }
             const result = await apiCall(`/api/servers/${SERVER_ID}/install`, 'POST', params);
             clearInterval(progressInterval);

templates/settings.html

@@ -650,6 +650,41 @@
             </div>
         </div>
 
+        <!-- BLOCK: Support / Donate (admin) -->
+        {% set donate_cfg = settings.get('donate') or {} %}
+        <div class="card" style="margin-top: var(--space-lg);">
+            <h3 class="card-title" style="margin-bottom: var(--space-lg);">{{ icon('heart') }} {{ _('donate_settings_title') }}</h3>
+            <p class="form-hint" style="margin-top: 0; margin-bottom: var(--space-md);">{{ _('donate_settings_hint') }}</p>
+            <div class="form-group">
+                <label class="form-label" style="display:flex; align-items:center; gap:8px; cursor:pointer;">
+                    <input type="checkbox" id="donate_enabled" {% if donate_cfg.get('enabled', True) %}checked{% endif %}>
+                    {{ _('donate_enabled') }}
+                </label>
+            </div>
+            <div class="form-group">
+                <label class="form-label">{{ _('donate_intro') }}</label>
+                <textarea class="form-textarea" id="donate_intro" rows="2" placeholder="{{ _('support_intro') }}">{{ donate_cfg.get('intro') or '' }}</textarea>
+            </div>
+            {% for key, label_key in [('sbp', 'donate_sbp'), ('card', 'donate_card'), ('crypto', 'donate_crypto')] %}
+            {% set method = donate_cfg.get(key) or {} %}
+            <div style="border:1px solid var(--border-color); border-radius:var(--radius-md); padding:var(--space-md); margin-bottom:var(--space-md);">
+                <label class="form-label" style="display:flex; align-items:center; gap:8px; cursor:pointer; margin-bottom:var(--space-sm);">
+                    <input type="checkbox" id="donate_{{ key }}_enabled" {% if method.get('enabled', True) %}checked{% endif %}>
+                    {{ _(label_key) }}
+                </label>
+                <div class="form-group" style="margin-bottom:var(--space-sm);">
+                    <label class="form-label">{{ _('donate_method_title') }}</label>
+                    <input type="text" class="form-input" id="donate_{{ key }}_title" value="{{ method.get('title') or '' }}" placeholder="{{ _(label_key) }}">
+                </div>
+                <div class="form-group" style="margin-bottom:0;">
+                    <label class="form-label">{{ _('donate_method_details') }}</label>
+                    <textarea class="form-textarea" id="donate_{{ key }}_details" rows="3" placeholder="{{ _('donate_details_placeholder') }}">{{ method.get('details') or '' }}</textarea>
+                </div>
+            </div>
+            {% endfor %}
+            <p class="form-hint">{{ _('donate_preview_hint') }} <a href="/support" target="_blank" rel="noopener">/support</a></p>
+        </div>
+
         <!-- BLOCK: About & Updates -->
         <div class="card" style="margin-top: var(--space-lg);">
             <h3 class="card-title" style="margin-bottom: var(--space-lg);">ℹ️ {{ _('about_title') }}</h3>
@@ -1478,11 +1513,24 @@
             create_xui_panel_id: document.getElementById('guest_create_xui_panel')?.value || '',
         };
 
+        const donateMethod = (key) => ({
+            enabled: document.getElementById(`donate_${key}_enabled`).checked,
+            title: document.getElementById(`donate_${key}_title`).value.trim(),
+            details: document.getElementById(`donate_${key}_details`).value.trim(),
+        });
+        const donate = {
+            enabled: document.getElementById('donate_enabled').checked,
+            intro: document.getElementById('donate_intro').value.trim(),
+            sbp: donateMethod('sbp'),
+            card: donateMethod('card'),
+            crypto: donateMethod('crypto'),
+        };
+
         try {
             const res = await fetch('/api/settings/save', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ appearance, sync, captcha, telegram, ssl, guest })
+                body: JSON.stringify({ appearance, sync, captcha, telegram, ssl, guest, donate })
             });
             if (!res.ok) throw new Error(_('error'));
             showToast(_('settings_saved'), 'success');
@@ -1496,7 +1544,7 @@
     }
 
     const guestServersData = {{ servers | default([]) | tojson }};
-    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy'];
+    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'mieru'];
     const PROTO_TITLES = {
         awg2: 'AmneziaWG 2.0',
         awg: 'AmneziaWG',
@@ -1506,6 +1554,7 @@
         telemt: 'Telemt',
         hysteria: 'Hysteria 2',
         naiveproxy: 'NaiveProxy',
+        mieru: 'Mieru',
         xui: '3x-ui VLESS',
     };
     function protoTitle(key) {

templates/support.html

@@ -0,0 +1,104 @@
+{% extends "base.html" %}
+{% from "macros/icons.html" import icon %}
+
+{% block title_extra %} — {{ _('nav_support') }}{% endblock %}
+
+{% block head_extra %}
+<style>
+    .support-hero {
+        text-align: center;
+        padding: var(--space-xl) var(--space-md);
+        margin-bottom: var(--space-xl);
+    }
+    .support-hero-icon {
+        font-size: 2.5rem;
+        margin-bottom: var(--space-md);
+        color: var(--accent);
+    }
+    .support-grid {
+        display: grid;
+        grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+        gap: var(--space-lg);
+        max-width: 960px;
+        margin: 0 auto;
+    }
+    .support-card {
+        border: 1px solid var(--border-color);
+        border-radius: var(--radius-lg);
+        padding: var(--space-lg);
+        background: var(--bg-secondary);
+        display: flex;
+        flex-direction: column;
+        gap: var(--space-md);
+    }
+    .support-card-title {
+        font-weight: 700;
+        font-size: 1.05rem;
+        display: flex;
+        align-items: center;
+        gap: var(--space-sm);
+    }
+    .support-details {
+        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+        font-size: 0.85rem;
+        white-space: pre-wrap;
+        word-break: break-word;
+        padding: var(--space-sm);
+        border-radius: var(--radius-md);
+        background: var(--bg-primary);
+        border: 1px dashed var(--border-color);
+        min-height: 4rem;
+        color: var(--text-muted);
+    }
+    .support-details.has-content {
+        color: var(--text-primary);
+        border-style: solid;
+    }
+</style>
+{% endblock %}
+
+{% block content %}
+<section class="support-hero">
+    <div class="support-hero-icon">{{ icon('heart') }}</div>
+    <h1 class="section-title" style="justify-content: center; margin-bottom: var(--space-sm);">
+        {{ _('support_title') }}
+    </h1>
+    <p class="text-muted" style="max-width: 560px; margin: 0 auto; line-height: 1.5;">
+        {% if donate.get('intro') %}
+        {{ donate.intro }}
+        {% else %}
+        {{ _('support_intro') }}
+        {% endif %}
+    </p>
+</section>
+
+<div class="support-grid">
+    {% set methods = [
+        ('sbp', _('donate_sbp'), '💳'),
+        ('card', _('donate_card'), '🏦'),
+        ('crypto', _('donate_crypto'), '₿'),
+    ] %}
+    {% for key, default_title, emoji in methods %}
+    {% set method = donate.get(key) or {} %}
+    {% if method.get('enabled', True) %}
+    <div class="card support-card">
+        <div class="support-card-title">
+            <span aria-hidden="true">{{ emoji }}</span>
+            <span>{{ method.get('title') or default_title }}</span>
+        </div>
+        {% set details = (method.get('details') or '').strip() %}
+        <div class="support-details{% if details %} has-content{% endif %}" id="donate-{{ key }}-details">{{ details or _('donate_details_soon') }}</div>
+        {% if details %}
+        <button type="button" class="btn btn-secondary btn-sm" onclick="copyToClipboard(document.getElementById('donate-{{ key }}-details').textContent)">
+            {{ icon('copy') }} {{ _('copy') }}
+        </button>
+        {% endif %}
+    </div>
+    {% endif %}
+    {% endfor %}
+</div>
+
+<p class="text-muted text-sm" style="text-align: center; margin-top: var(--space-xl); max-width: 520px; margin-left: auto; margin-right: auto;">
+    {{ _('support_footer') }}
+</p>
+{% endblock %}

templates/users.html

@@ -631,7 +631,7 @@
         const select = document.getElementById(selectId);
         const group = groupId ? document.getElementById(groupId) : null;
         select.innerHTML = '';
-        const vpnOrder = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy'];
+        const vpnOrder = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria', 'naiveproxy', 'mieru'];
         const titles = {
             awg2: 'AmneziaWG 2.0',
             awg: 'AmneziaWG',
@@ -641,6 +641,7 @@
             telemt: 'Telemt',
             hysteria: 'Hysteria 2',
             naiveproxy: 'NaiveProxy',
+            mieru: 'Mieru',
             xui: '3x-ui VLESS',
         };
         const protoTitle = (key) => {

translations/en.json

@@ -4,6 +4,7 @@
     "nav_invites":  "Invite links",
     "nav_settings":  "Settings",
     "nav_connections":  "Connections",
+    "nav_support":  "Support",
     "nav_logout":  "Logout",
     "theme_dark":  "Dark",
     "theme_light":  "Light",
@@ -394,6 +395,12 @@
     "naiveproxy_dns_hint":  "Create this DNS record before installation:",
     "naiveproxy_ports_warning":  "Warning: free TCP ports 80 and 443 are required for stable operation (Let\u0027s Encrypt on 80, HTTPS proxy on 443).",
     "naiveproxy_client_hint":  "Stable build. Do NOT use v2rayN. Confirmed working in Karing. Other clients are untested.",
+    "mieru_desc":  "Mieru (mita v3.28.0) — native TCP proxy from enfein/mieru. No Docker required. Client: mieru app or Clash.Meta/mihomo.",
+    "mieru_version":  "Version",
+    "mieru_port_hint":  "TCP port for mita (1025–65535). Open it in the server firewall.",
+    "mieru_install_hint":  "Installs the official mita package from GitHub release v3.28.0 (Debian/RPM). Requires Linux with systemd.",
+    "mieru_ports_warning":  "Warning: ensure the chosen TCP port is free and allowed through the firewall.",
+    "mieru_client_hint":  "Share links use mierus:// format. Import into the mieru client or Clash.Meta (type: mieru).",
     "server_ssl_domain":  "SSL domain (default)",
     "server_ssl_email":  "SSL email (default)",
     "server_ssl_hint":  "Used when installing Hysteria / NGINX on this server (Let's Encrypt).",
@@ -405,6 +412,21 @@
     "server_connect_domain_ssh":  "SSH",
     "server_connect_domain_saved":  "Connection domain saved",
     "server_endpoint_label":  "Endpoint",
+    "support_title":  "Support the project",
+    "support_intro":  "If this panel helps you, you can support development. Choose a convenient method below.",
+    "support_footer":  "Thank you for using Amnezia Web Panel.",
+    "donate_sbp":  "SBP (Fast Payments)",
+    "donate_card":  "Bank card",
+    "donate_crypto":  "Cryptocurrency",
+    "donate_details_soon":  "Payment details will be added soon.",
+    "donate_settings_title":  "Support / donations",
+    "donate_settings_hint":  "Shown on the /support page for all users. No popups — only when they open the page.",
+    "donate_enabled":  "Show support page in navigation",
+    "donate_intro":  "Page intro text (optional)",
+    "donate_method_title":  "Button title (optional)",
+    "donate_method_details":  "Payment details",
+    "donate_details_placeholder":  "Phone, card number, wallet address…",
+    "donate_preview_hint":  "Preview:",
     "container_logs":  "Container logs",
     "logs_btn":  "📋 Logs",
     "logs_live":  "Live",

translations/fa.json

@@ -384,6 +384,12 @@
     "naiveproxy_dns_hint":  "قبل از نصب این رکورد DNS را بسازید:",
     "naiveproxy_ports_warning":  "هشدار: برای کار پایدار پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let\u0027s Encrypt روی ۸۰، پروکسی HTTPS روی ۴۴۳).",
     "naiveproxy_client_hint":  "نسخه پایدار. از v2rayN استفاده نکنید. در Karing تأیید شده. سایر کلاینت‌ها آزمایش نشده‌اند.",
+    "mieru_desc":  "Mieru (mita v3.28.0) — پروکسی TCP بومی enfein/mieru. بدون Docker. کلاینت: mieru یا Clash.Meta/mihomo.",
+    "mieru_version":  "نسخه",
+    "mieru_port_hint":  "پورت TCP برای mita (۱۰۲۵–۶۵۵۳۵). در فایروال سرور باز کنید.",
+    "mieru_install_hint":  "بسته رسمی mita را از GitHub v3.28.0 نصب می‌کند (Debian/RPM). لینوکس با systemd لازم است.",
+    "mieru_ports_warning":  "هشدار: پورت TCP انتخابی باید آزاد و در فایروال مجاز باشد.",
+    "mieru_client_hint":  "لینک‌ها با فرمت mierus://. در کلاینت mieru یا Clash.Meta (type: mieru) وارد کنید.",
     "server_ssl_domain":  "دامنه SSL (پیش‌فرض)",
     "server_ssl_email":  "ایمیل SSL (پیش‌فرض)",
     "server_ssl_hint":  "هنگام نصب Hysteria / NGINX روی این سرور استفاده می‌شود (Let\u0027s Encrypt).",

translations/fr.json

@@ -384,6 +384,12 @@
     "naiveproxy_dns_hint":  "Créez cet enregistrement DNS avant l\u0027installation :",
     "naiveproxy_ports_warning":  "Attention : les ports TCP 80 et 443 doivent être libres pour un fonctionnement stable (Let\u0027s Encrypt sur 80, proxy HTTPS sur 443).",
     "naiveproxy_client_hint":  "Version stable. N\u0027utilisez PAS v2rayN. Fonctionne avec Karing. Autres clients non testés.",
+    "mieru_desc":  "Mieru (mita v3.28.0) — proxy TCP natif enfein/mieru. Pas besoin de Docker. Client : mieru ou Clash.Meta/mihomo.",
+    "mieru_version":  "Version",
+    "mieru_port_hint":  "Port TCP pour mita (1025–65535). Ouvrez-le dans le pare-feu du serveur.",
+    "mieru_install_hint":  "Installe le paquet officiel mita depuis GitHub v3.28.0 (Debian/RPM). Linux avec systemd requis.",
+    "mieru_ports_warning":  "Attention : le port TCP choisi doit être libre et autorisé dans le pare-feu.",
+    "mieru_client_hint":  "Liens au format mierus://. Importez dans le client mieru ou Clash.Meta (type: mieru).",
     "server_ssl_domain":  "Domaine SSL (par défaut)",
     "server_ssl_email":  "Email SSL (par défaut)",
     "server_ssl_hint":  "Utilisé lors de l\u0027installation de Hysteria / NGINX sur ce serveur (Let\u0027s Encrypt).",

translations/ru.json

@@ -4,6 +4,7 @@
     "nav_invites":  "Ссылки",
     "nav_settings":  "Настройки",
     "nav_connections":  "Подключения",
+    "nav_support":  "Поддержать",
     "nav_logout":  "Выход",
     "theme_dark":  "Темная",
     "theme_light":  "Светлая",
@@ -394,6 +395,12 @@
     "naiveproxy_dns_hint":  "Перед установкой создайте DNS-запись:",
     "naiveproxy_ports_warning":  "Внимание: для стабильной работы нужны свободные TCP-порты 80 и 443 (Let\u0027s Encrypt на 80, HTTPS-прокси на 443).",
     "naiveproxy_client_hint":  "Стабильная версия. НЕ используйте v2rayN. Точно работает в Karing. Остальные клиенты под вопросом.",
+    "mieru_desc":  "Mieru (mita v3.28.0) — нативный TCP-прокси из enfein/mieru. Docker не нужен. Клиент: приложение mieru или Clash.Meta/mihomo.",
+    "mieru_version":  "Версия",
+    "mieru_port_hint":  "TCP-порт для mita (1025–65535). Откройте его в фаерволе сервера.",
+    "mieru_install_hint":  "Устанавливает официальный пакет mita с GitHub релиза v3.28.0 (Debian/RPM). Нужен Linux со systemd.",
+    "mieru_ports_warning":  "Внимание: выбранный TCP-порт должен быть свободен и разрешён в фаерволе.",
+    "mieru_client_hint":  "Ссылки в формате mierus://. Импорт в клиент mieru или Clash.Meta (type: mieru).",
     "server_ssl_domain":  "SSL-домен (по умолчанию)",
     "server_ssl_email":  "SSL-email (по умолчанию)",
     "server_ssl_hint":  "Подставляется при установке Hysteria / NGINX на этом сервере (Let's Encrypt).",
@@ -405,6 +412,21 @@
     "server_connect_domain_ssh":  "SSH",
     "server_connect_domain_saved":  "Домен подключения сохранён",
     "server_endpoint_label":  "Endpoint",
+    "support_title":  "Поддержать проект",
+    "support_intro":  "Если панель вам помогает, можно поддержать разработку. Выберите удобный способ ниже.",
+    "support_footer":  "Спасибо, что пользуетесь Amnezia Web Panel.",
+    "donate_sbp":  "СБП",
+    "donate_card":  "Банковская карта",
+    "donate_crypto":  "Криптовалюта",
+    "donate_details_soon":  "Реквизиты будут добавлены позже.",
+    "donate_settings_title":  "Поддержка / донат",
+    "donate_settings_hint":  "Страница /support для всех пользователей. Без всплывающих окон — только по ссылке в меню.",
+    "donate_enabled":  "Показывать страницу поддержки в меню",
+    "donate_intro":  "Текст в начале страницы (необязательно)",
+    "donate_method_title":  "Название кнопки (необязательно)",
+    "donate_method_details":  "Реквизиты",
+    "donate_details_placeholder":  "Телефон, номер карты, адрес кошелька…",
+    "donate_preview_hint":  "Предпросмотр:",
     "container_logs":  "Логи контейнера",
     "logs_btn":  "📋 Логи",
     "logs_live":  "В реальном времени",

translations/zh.json

@@ -384,6 +384,12 @@
     "naiveproxy_dns_hint":  "安装前请创建此 DNS 记录：",
     "naiveproxy_ports_warning":  "注意：稳定运行需要空闲的 TCP 端口 80 和 443（Let\u0027s Encrypt 使用 80，HTTPS 代理使用 443）。",
     "naiveproxy_client_hint":  "稳定版。请勿使用 v2rayN。已确认 Karing 可用。其他客户端未测试。",
+    "mieru_desc":  "Mieru（mita v3.28.0）— enfein/mieru 原生 TCP 代理，无需 Docker。客户端：mieru 或 Clash.Meta/mihomo。",
+    "mieru_version":  "版本",
+    "mieru_port_hint":  "mita 的 TCP 端口（1025–65535）。请在服务器防火墙中放行。",
+    "mieru_install_hint":  "从 GitHub v3.28.0 安装官方 mita 包（Debian/RPM）。需要带 systemd 的 Linux。",
+    "mieru_ports_warning":  "注意：所选 TCP 端口必须空闲，并在防火墙中允许。",
+    "mieru_client_hint":  "分享链接为 mierus:// 格式。可导入 mieru 客户端或 Clash.Meta（type: mieru）。",
     "server_ssl_domain":  "SSL 域名（默认）",
     "server_ssl_email":  "SSL 邮箱（默认）",
     "server_ssl_hint":  "安装 Hysteria / NGINX 时自动填入（Let\u0027s Encrypt）。",