OpeItcLoc03/admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
165 Commits 1 Branch 0 Tags
cacd58230324ddcb1b73cbd788b0acd98d72fc5e
Commit Graph

5 Commits

Author SHA1 Message Date
vitya
cacd582303 fix(nl-vds-3xui): disable ML-DSA-65 PQ on Reality 443 — GUI clients can't connect 
Root cause of "Reality fails on client": v2rayN 7.19.5 + phone apps do NOT emit
mldsa65Verify to the xray core, so they can't auth to a PQ-mandated REALITY
inbound (only plain VLESS 32030 worked). Replica matrix: noPQ+no-verify=204,
PQ+no-verify=000, noPQ+with-verify=000. Removed mldsa65Seed from inbound id=1 ->
standard Reality X25519. Verified verify-less client through real :443 -> 204.
Fresh X25519 share-link generated for re-import. Wiki concept updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 12:31:31 +03:00
vitya
b23ca3a890 feat(nl-vds-3xui): add MTProto proxy (mtg) on :8443, FakeTLS 
SOCKS5 works server-side but DPI on user's path blocks it -> stood up mtg
v2.2.8 as systemd service (DynamicUser, Restart=always), FakeTLS domain
www.cloudflare.com. Verified: openssl probe -> valid TLS1.3 CN=www.cloudflare.com
(indistinguishable from real HTTPS). Secret + tg link in pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 12:00:39 +03:00
vitya
c87d7e7442 wiki(nl-vds-3xui): add SOCKS5 inbound (port 47020) for Telegram 
socks5 auth=password inbound added via x-ui.db insert + restart (self-rollback
guard, not triggered). Verified external: auth enforced, no-auth rejected,
exits via NL node. Creds in pass nl-vds-3xui/full-env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 11:50:36 +03:00
vitya
fc245c23c7 fix(nl-vds-3xui): apply Reality dest fix + rotate creds (server-side done) 
Per user "и то и другое":
- Reality 443 dest www.intel.com -> www.microsoft.com (x-ui.db + restart),
  verified end-to-end tunnel through real :443 (SNI microsoft) -> HTTP 204.
  ML-DSA-65 kept. Plain VLESS 32030 unaffected (xray restarted, listening).
- Rotated leaked creds: root SSH password, panel username+password (bcrypt),
  panel JWT secret (kills install API token + sessions). New creds in
  pass nl-vds-3xui/full-env; old SSH pass now rejected; db backed up on server.
- Remaining client-side: user sets v2rayN profile pqmkayaxo2 SNI -> microsoft.

Task fix-nl-vds-reality-pq-dest -> 🟡 (awaiting client-side + confirm).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 11:45:44 +03:00
vitya
4fc7cbf688 wiki(nl-vds-3xui): new NL 3x-UI node + Reality PQ×dest root-cause 
Reality 443 inbound silently fails: ML-DSA-65 (post-quantum) ClientHello
key-share X25519MLKEM768 relayed to dest www.intel.com (Akamai) -> HRR ->
borrowed-TLS handshake never completes. Plain VLESS 32030 unaffected.
Isolated via replica xray pair (matrix: intel+PQ is the only failing cell).
Fix (NOT applied, awaiting user): switch dest/SNI -> www.microsoft.com
(PQ-capable, verified) on both inbound and client profile.

- new entities/nl-vds-3xui.md
- new concepts/reality-pq-mldsa65-dest-incompatibility.md
- index.md + log.md updated
- creds saved to pass nl-vds-3xui/full-env (not in repo)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 11:26:16 +03:00