Release v2.1.0: mark NaiveProxy stable with client notes.

Stable NaiveProxy; note that v2rayN must not be used, Karing is confirmed, other clients are untested.

README.md

@@ -63,7 +63,7 @@ Configuration panel for system parameters and preferences:
     *   **Classic WireGuard**: Standard, high-performance WireGuard protocol for unmatched speed and broad device compatibility with traffic monitoring support.
     *   **Xray (XTLS-Reality)**: Stealthy protocol that masks VPN traffic as standard HTTPS browsing. Pinned to **Xray-core v26.x**; transparently reads both the **panel layout** (`meta.json` + `clientsTable.json`) and the **native Amnezia client layout** (`xray_*.key` files + `clientsTable`), so a node first installed via the official mobile/desktop app can be attached to the panel without re-installation.
     *   **Hysteria 2**: QUIC/HTTP3 proxy from [apernet/hysteria](https://github.com/apernet/hysteria) via `tobyxdd/hysteria:v2` — Let's Encrypt TLS, salamander obfuscation, password auth, `hy2://` share links. Per-server SSL domain/email defaults, renew from settings; install requires free TCP **80** and **443**.
-    *   **NaiveProxy**: HTTPS/HTTP2 camouflage proxy via [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) (Caddy + [klzgrad/forwardproxy](https://github.com/klzgrad/forwardproxy) naïve fork). ACME TLS on the domain, per-client basic auth, `naive+https://` share links. Requires free TCP **80** and **443**.
+    *   **NaiveProxy** (stable): HTTPS/HTTP2 camouflage proxy via [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) (Caddy + [klzgrad/forwardproxy](https://github.com/klzgrad/forwardproxy) naïve fork). ACME TLS on the domain, per-client basic auth, `naive+https://` share links. Requires free TCP **80** and **443**. **Use Karing** as the client — do **not** use v2rayN; other clients are untested.
     *   **Telemt (Telegram MTProxy)**: High-performance Telegram MTProxy with TLS emulation and comprehensive management (quotas, IP limits, real-time session tracking). Robust install path that auto-configures Docker's official apt/yum repository when needed.
     *   **Cloudflare WARP**: Add and manage WARP-powered connectivity from the panel for routing and network flexibility.
 *   **🛠 Services**:
@@ -222,6 +222,14 @@ GitHub Actions workflows in `.github/workflows/`:
 
 ## 📋 Fix / changelog (this fork)
 
+### v2.1.0
+*   **NaiveProxy — stable**: production-ready install (Caddy + klzgrad/forwardproxy), share links always include `:443`.
+*   **Client notes (important)**:
+    *   **Do not use v2rayN** with NaiveProxy (broken DNS/IPv6 behaviour → latency −1 ms even when the server is fine).
+    *   **Karing** — confirmed working.
+    *   Other clients — untested / use at your own risk.
+*   Share-link and config UI hints updated accordingly.
+
 ### v2.0.0-beta
 *   **NaiveProxy** (Beta): install [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) server via Caddy + naïve [forwardproxy](https://github.com/klzgrad/forwardproxy) — domain TLS (ACME), per-client basic auth, `naive+https://` share links.
 *   Marketplace / server page / users / invites / Telegram / backups include NaiveProxy.

app.py

@@ -101,7 +101,7 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.0.0-beta"
+CURRENT_VERSION = "v2.1.0"
 RELEASES_REPO_URL = "https://git.evilfox.cc/test2/Amnezia-Web-Panel-main"
 RELEASES_API_LATEST = "https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest"
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))

managers/naiveproxy_manager.py

@@ -232,9 +232,13 @@ class NaiveProxyManager:
             # Keep a non-shared bootstrap user so the proxy is never open
             auth_lines = [f'    basic_auth bootstrap {_rand_token(24)}']
         auth_block = '\n'.join(auth_lines)
+        # probe_resistance looks like a fake domain to browsers
         probe = (probe_path or _rand_token(12)).strip('/')
+        if '.' not in probe:
+            probe = f'{probe}.com'
         return f"""{{
   order forward_proxy before file_server
+  admin off
   log {{
     exclude http.log.error
   }}
@@ -242,16 +246,14 @@ class NaiveProxyManager:
 :443, {domain} {{
   tls {email}
   encode
-  route {{
-    forward_proxy {{
+  forward_proxy {{
 {auth_block}
-      hide_ip
-      hide_via
-      probe_resistance {probe}
-    }}
-    file_server {{
-      root /var/www/html
-    }}
+    hide_ip
+    hide_via
+    probe_resistance {probe}
+  }}
+  file_server {{
+    root /var/www/html
   }}
 }}
 """
@@ -398,13 +400,21 @@ CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile
             self._start_container()
 
     def _build_share_uri(self, domain, username, password, name, port=443):
+        """v2rayN / NekoRay / sing-box compatible share link.
+
+        Always include an explicit port — without `:443` v2rayN often treats
+        the port as empty/80 and shows «Свойство Порт недопустимо» / SSL errors.
+        """
+        # Keep credentials unescaped when alphanumeric (our generator); quote otherwise.
         user = quote(username or '', safe='')
         pw = quote(password or '', safe='')
-        host = domain or ''
+        host = (domain or '').strip().lower()
         port = int(port or 443)
-        authority = f'{user}:{pw}@{host}' if port == 443 else f'{user}:{pw}@{host}:{port}'
-        fragment = quote(name or 'naiveproxy', safe='')
-        return f'naive+https://{authority}#{fragment}'
+        if port < 1 or port > 65535:
+            port = 443
+        # Remark: ASCII-safe, no spaces that break some importers
+        remark = re.sub(r'[^\w.\-]+', '-', (name or 'naiveproxy').strip())[:48] or 'naiveproxy'
+        return f'naive+https://{user}:{pw}@{host}:{port}#{remark}'
 
     # ===================== INSTALL / REMOVE =====================
 

templates/server.html

@@ -325,10 +325,11 @@
             <div class="protocol-icon">{{ icon('link') }}</div>
             <div class="flex gap-sm" id="naiveproxy-ctrl" style="display:none!important;"></div>
         </div>
-        <div class="protocol-name">NaiveProxy</div>
-        <div class="protocol-desc">
-            {{ _('naiveproxy_desc') }}
-        </div>
+            <div class="protocol-name">NaiveProxy <span
+                style="font-size:0.65rem; background:var(--success, #16a34a); color:#fff; padding:2px 6px; border-radius:8px; vertical-align:middle;">STABLE</span></div>
+            <div class="protocol-desc">
+                {{ _('naiveproxy_desc') }}
+            </div>
         <div class="protocol-status" id="naiveproxy-status">
             <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
         </div>
@@ -743,6 +744,7 @@
                 </div>
                 <div class="form-hint">{{ _('naiveproxy_install_hint') }}</div>
                 <div class="form-hint" style="margin-top: var(--space-sm);">{{ _('naiveproxy_port_hint') }}</div>
+                <div class="form-hint" style="margin-top: var(--space-sm); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">{{ _('naiveproxy_client_hint') }}</div>
             </div>
 
             <div class="modal-footer">
@@ -986,6 +988,7 @@
         <div class="config-panel active" id="panel-conf">
             <div class="config-display">
                 <div class="config-text" id="configText"></div>
+                <div class="form-hint hidden" id="configClientHint" style="margin-top: var(--space-sm);"></div>
                 <div class="config-actions">
                     <button class="btn btn-secondary btn-sm" onclick="copyToClipboard(currentConfig)" style="flex:1">
                         {{ _('copy') }}
@@ -1097,7 +1100,7 @@
         { proto: 'xray', category: 'protocols', icon: 'zap', title: 'Xray (VLESS-Reality)', descKey: 'xray_desc' },
         { proto: 'telemt', category: 'protocols', icon: 'plane', title: 'Telemt (Telegram Proxy)', descKey: 'telemt_desc' },
         { proto: 'hysteria', category: 'protocols', icon: 'refresh', title: 'Hysteria 2', descKey: 'hysteria_desc' },
-        { proto: 'naiveproxy', category: 'protocols', icon: 'link', title: 'NaiveProxy', descKey: 'naiveproxy_desc' },
+        { proto: 'naiveproxy', category: 'protocols', icon: 'link', title: 'NaiveProxy', descKey: 'naiveproxy_desc', badge: 'STABLE' },
         { proto: 'wireguard', category: 'protocols', icon: 'lock', title: 'WireGuard', descKey: 'wireguard_desc' },
         { proto: 'dns', category: 'services', icon: 'search', title: 'AmneziaDNS', descKey: 'dns_desc' },
         { proto: 'adguard', category: 'services', icon: 'shield-check', title: 'AdGuard Home', descKey: 'adguard_desc' },
@@ -2840,6 +2843,16 @@
                 document.getElementById('configModalTitle').textContent = `${_('config')} — ${connName}`;
                 document.getElementById('configText').textContent = result.config;
                 document.getElementById('vpnLinkText').textContent = currentVpnLink;
+                const hintEl = document.getElementById('configClientHint');
+                if (hintEl) {
+                    if (protoBase(proto) === 'naiveproxy') {
+                        hintEl.textContent = _('naiveproxy_client_hint');
+                        hintEl.classList.remove('hidden');
+                    } else {
+                        hintEl.textContent = '';
+                        hintEl.classList.add('hidden');
+                    }
+                }
                 switchConfigTab('conf');
                 openModal('configModal');
                 generateQR(result.config);

translations/en.json

@@ -364,13 +364,14 @@
   "hysteria_renew_ssl": "Renew SSL",
   "hysteria_ssl_change_hint": "Changing the domain re-issues the Let's Encrypt certificate (port 80 must be free).",
   "hysteria_ssl_required": "Domain and email are required for SSL",
-  "naiveproxy_desc": "NaiveProxy (Caddy + forwardproxy) — HTTPS/HTTP2 proxy with Let's Encrypt TLS. Admin sets the domain at install time.",
+  "naiveproxy_desc": "NaiveProxy (stable) — HTTPS/HTTP2 via Caddy + forwardproxy, Let's Encrypt TLS. Client: use Karing. Do not use v2rayN; other clients untested.",
   "naiveproxy_domain": "Domain",
   "naiveproxy_email": "Let's Encrypt email",
   "naiveproxy_port_hint": "TCP port 443 is fixed for NaiveProxy. Port 80/TCP must be free for certificate issuance.",
   "naiveproxy_install_hint": "Point the domain A-record to this server before install. Free TCP ports 80 and 443 are required (Let's Encrypt and HTTPS proxy).",
   "naiveproxy_dns_hint": "Create this DNS record before installation:",
   "naiveproxy_ports_warning": "Warning: free TCP ports 80 and 443 are required for stable operation (Let's Encrypt on 80, HTTPS proxy on 443).",
+  "naiveproxy_client_hint": "Stable build. Do NOT use v2rayN. Confirmed working in Karing. Other clients are untested.",
   "server_ssl_domain": "SSL domain (default)",
   "server_ssl_email": "SSL email (default)",
   "server_ssl_hint": "Used when installing Hysteria / NGINX on this server (Let's Encrypt).",

translations/fa.json

@@ -354,13 +354,14 @@
   "hysteria_renew_ssl": "تمدید SSL",
   "hysteria_ssl_change_hint": "تغییر دامنه گواهی Let's Encrypt را دوباره صادر می‌کند (پورت ۸۰ باید آزاد باشد).",
   "hysteria_ssl_required": "برای SSL دامنه و ایمیل لازم است",
-  "naiveproxy_desc": "NaiveProxy (Caddy + forwardproxy) — پروکسی HTTPS/HTTP2 با TLS از Let's Encrypt. دامنه را ادمین هنگام نصب مشخص می‌کند.",
+  "naiveproxy_desc": "NaiveProxy (پایدار) — HTTPS/HTTP2 با Caddy + forwardproxy و TLS از Let's Encrypt. کلاینت: Karing. از v2rayN استفاده نکنید؛ بقیه آزمایش نشده‌اند.",
   "naiveproxy_domain": "دامنه",
   "naiveproxy_email": "ایمیل Let's Encrypt",
   "naiveproxy_port_hint": "پورت TCP 443 برای NaiveProxy ثابت است. پورت 80/TCP باید برای صدور گواهی آزاد باشد.",
   "naiveproxy_install_hint": "قبل از نصب، رکورد A دامنه باید به این سرور اشاره کند. پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let's Encrypt و پروکسی HTTPS).",
   "naiveproxy_dns_hint": "قبل از نصب این رکورد DNS را بسازید:",
   "naiveproxy_ports_warning": "هشدار: برای کار پایدار پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let's Encrypt روی ۸۰، پروکسی HTTPS روی ۴۴۳).",
+  "naiveproxy_client_hint": "نسخه پایدار. از v2rayN استفاده نکنید. در Karing تأیید شده. سایر کلاینت‌ها آزمایش نشده‌اند.",
   "server_ssl_domain": "دامنه SSL (پیش‌فرض)",
   "server_ssl_email": "ایمیل SSL (پیش‌فرض)",
   "server_ssl_hint": "هنگام نصب Hysteria / NGINX روی این سرور استفاده می‌شود (Let's Encrypt).",

translations/fr.json

@@ -354,13 +354,14 @@
   "hysteria_renew_ssl": "Renouveler SSL",
   "hysteria_ssl_change_hint": "Changer le domaine réémet le certificat Let's Encrypt (le port 80 doit être libre).",
   "hysteria_ssl_required": "Domaine et email requis pour SSL",
-  "naiveproxy_desc": "NaiveProxy (Caddy + forwardproxy) — proxy HTTPS/HTTP2 avec TLS Let's Encrypt. Le domaine est défini par l'admin à l'installation.",
+  "naiveproxy_desc": "NaiveProxy (stable) — HTTPS/HTTP2 via Caddy + forwardproxy, TLS Let's Encrypt. Client : utilisez Karing. N'utilisez pas v2rayN ; autres clients non testés.",
   "naiveproxy_domain": "Domaine",
   "naiveproxy_email": "Email Let's Encrypt",
   "naiveproxy_port_hint": "Le port TCP 443 est fixe pour NaiveProxy. Le port 80/TCP doit être libre pour l'émission du certificat.",
   "naiveproxy_install_hint": "L'enregistrement A du domaine doit pointer vers ce serveur. Les ports TCP 80 et 443 doivent être libres (Let's Encrypt et proxy HTTPS).",
   "naiveproxy_dns_hint": "Créez cet enregistrement DNS avant l'installation :",
   "naiveproxy_ports_warning": "Attention : les ports TCP 80 et 443 doivent être libres pour un fonctionnement stable (Let's Encrypt sur 80, proxy HTTPS sur 443).",
+  "naiveproxy_client_hint": "Version stable. N'utilisez PAS v2rayN. Fonctionne avec Karing. Autres clients non testés.",
   "server_ssl_domain": "Domaine SSL (par défaut)",
   "server_ssl_email": "Email SSL (par défaut)",
   "server_ssl_hint": "Utilisé lors de l'installation de Hysteria / NGINX sur ce serveur (Let's Encrypt).",

translations/ru.json

@@ -364,13 +364,14 @@
   "hysteria_renew_ssl": "Обновить SSL",
   "hysteria_ssl_change_hint": "Смена домена заново выпускает сертификат Let's Encrypt (порт 80 должен быть свободен).",
   "hysteria_ssl_required": "Для SSL нужны домен и email",
-  "naiveproxy_desc": "NaiveProxy (Caddy + forwardproxy) — HTTPS/HTTP2 прокси с TLS от Let's Encrypt. Домен указывает админ при установке.",
+  "naiveproxy_desc": "NaiveProxy (стабильный) — HTTPS/HTTP2 через Caddy + forwardproxy, TLS Let's Encrypt. Клиент: используйте Karing. Не используйте v2rayN; остальные клиенты под вопросом.",
   "naiveproxy_domain": "Домен",
   "naiveproxy_email": "Email для Let's Encrypt",
   "naiveproxy_port_hint": "TCP-порт 443 фиксирован для NaiveProxy. Порт 80/TCP должен быть свободен для выпуска сертификата.",
   "naiveproxy_install_hint": "Перед установкой A-запись домена должна указывать на этот сервер. Нужны свободные TCP-порты 80 и 443 (Let's Encrypt и HTTPS-прокси).",
   "naiveproxy_dns_hint": "Перед установкой создайте DNS-запись:",
   "naiveproxy_ports_warning": "Внимание: для стабильной работы нужны свободные TCP-порты 80 и 443 (Let's Encrypt на 80, HTTPS-прокси на 443).",
+  "naiveproxy_client_hint": "Стабильная версия. НЕ используйте v2rayN. Точно работает в Karing. Остальные клиенты под вопросом.",
   "server_ssl_domain": "SSL-домен (по умолчанию)",
   "server_ssl_email": "SSL-email (по умолчанию)",
   "server_ssl_hint": "Подставляется при установке Hysteria / NGINX на этом сервере (Let's Encrypt).",

translations/zh.json

@@ -354,13 +354,14 @@
   "hysteria_renew_ssl": "续签 SSL",
   "hysteria_ssl_change_hint": "更改域名会重新签发 Let's Encrypt 证书（需空闲端口 80）。",
   "hysteria_ssl_required": "签发 SSL 需要域名和邮箱",
-  "naiveproxy_desc": "NaiveProxy（Caddy + forwardproxy）— 带 Let's Encrypt TLS 的 HTTPS/HTTP2 代理。安装时由管理员指定域名。",
+  "naiveproxy_desc": "NaiveProxy（稳定）— Caddy + forwardproxy 的 HTTPS/HTTP2，Let's Encrypt TLS。客户端请用 Karing，不要用 v2rayN；其他客户端未测试。",
   "naiveproxy_domain": "域名",
   "naiveproxy_email": "Let's Encrypt 邮箱",
   "naiveproxy_port_hint": "NaiveProxy 固定使用 TCP 443。签发证书需空闲 TCP 80。",
   "naiveproxy_install_hint": "安装前请将域名 A 记录指向本服务器。需空闲 TCP 端口 80 和 443（Let's Encrypt 与 HTTPS 代理）。",
   "naiveproxy_dns_hint": "安装前请创建此 DNS 记录：",
   "naiveproxy_ports_warning": "注意：稳定运行需要空闲的 TCP 端口 80 和 443（Let's Encrypt 使用 80，HTTPS 代理使用 443）。",
+  "naiveproxy_client_hint": "稳定版。请勿使用 v2rayN。已确认 Karing 可用。其他客户端未测试。",
   "server_ssl_domain": "SSL 域名（默认）",
   "server_ssl_email": "SSL 邮箱（默认）",
   "server_ssl_hint": "安装 Hysteria / NGINX 时自动填入（Let's Encrypt）。",