b23ca3a890
feat(nl-vds-3xui): add MTProto proxy (mtg) on :8443, FakeTLS
...
SOCKS5 works server-side but DPI on user's path blocks it -> stood up mtg
v2.2.8 as systemd service (DynamicUser, Restart=always), FakeTLS domain
www.cloudflare.com. Verified: openssl probe -> valid TLS1.3 CN=www.cloudflare.com
(indistinguishable from real HTTPS). Secret + tg link in pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 12:00:39 +03:00
c87d7e7442
wiki(nl-vds-3xui): add SOCKS5 inbound (port 47020) for Telegram
...
socks5 auth=password inbound added via x-ui.db insert + restart (self-rollback
guard, not triggered). Verified external: auth enforced, no-auth rejected,
exits via NL node. Creds in pass nl-vds-3xui/full-env.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 11:50:36 +03:00
fc245c23c7
fix(nl-vds-3xui): apply Reality dest fix + rotate creds (server-side done)
...
Per user "и то и другое":
- Reality 443 dest www.intel.com -> www.microsoft.com (x-ui.db + restart),
verified end-to-end tunnel through real :443 (SNI microsoft) -> HTTP 204.
ML-DSA-65 kept. Plain VLESS 32030 unaffected (xray restarted, listening).
- Rotated leaked creds: root SSH password, panel username+password (bcrypt),
panel JWT secret (kills install API token + sessions). New creds in
pass nl-vds-3xui/full-env; old SSH pass now rejected; db backed up on server.
- Remaining client-side: user sets v2rayN profile pqmkayaxo2 SNI -> microsoft.
Task fix-nl-vds-reality-pq-dest -> 🟡 (awaiting client-side + confirm).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 11:45:44 +03:00
4fc7cbf688
wiki(nl-vds-3xui): new NL 3x-UI node + Reality PQ×dest root-cause
...
Reality 443 inbound silently fails: ML-DSA-65 (post-quantum) ClientHello
key-share X25519MLKEM768 relayed to dest www.intel.com (Akamai) -> HRR ->
borrowed-TLS handshake never completes. Plain VLESS 32030 unaffected.
Isolated via replica xray pair (matrix: intel+PQ is the only failing cell).
Fix (NOT applied, awaiting user): switch dest/SNI -> www.microsoft.com
(PQ-capable, verified) on both inbound and client profile.
- new entities/nl-vds-3xui.md
- new concepts/reality-pq-mldsa65-dest-incompatibility.md
- index.md + log.md updated
- creds saved to pass nl-vds-3xui/full-env (not in repo)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 11:26:16 +03:00
