- Replace `${UUID}` with `${SIP022_PASSWORD}` in Clash configuration
- Ensure consistent SS password across all clients (ShadowRocket, V2rayN, NekoBox, Sing-box)
- Fix connection issues caused by inconsistent passwords
Security: Add pinnedPeerCertSha256 for Hy2/Trojan in v2rayN to prevent MITM (replaces AllowInsecure).
Compatibility: Refactor SFM/SFI/SFA configs for sing-box v1.13.0+.
- Auto-create Argo tunnels using Cloudflare API tokens with auto DNS setup
- Intelligent GitHub proxy fallback: test direct first, then cycle proxies
- Support 3 Argo auth methods: Token, Json, and API token
- Add comprehensive API token permission requirements to README
- Update documentation with Cloudflare API setup instructions
Credits: Thanks to zmlu for Cloudflare API implementation approach
- Add SNI (Server Name Indication) support to Hysteria2, Tuic, Trojan, and AnyTLS protocols for improved TLS handshake compatibility
- Update self-signed certificate public key configuration across affected protocol inbound configurations
- Add detailed documentation on handling self-signed certificates in various client applications
- Include client-specific instructions for certificate validation and bypass methods
- Improve security posture by leveraging SNI for better certificate verification workflows
- Update configuration templates and inline comments for clarity on certificate usage per protocol
Add the full GNU General Public License v3.0 text to the project root (LICENSE) and
include the SPDX identifier (SPDX-License-Identifier: GPL-3.0-or-later). Update README
to reference the LICENSE file.
s6-overlay vs supervisord — Memory Footprint Comparison
s6-overlay:
Uses only 1–2 MB of RAM. Its service processes typically consume around 200 KB RSS each.
Extremely lightweight, written in C, minimal overhead.
supervisord:
Consumes roughly 10–15 MB of RAM in real-world usage.
Implemented in Python, so it naturally has a higher baseline memory footprint (≈8–10× s6-overlay).
1. Local-First Reality Key Computation: Prioritize on-device calculation of public key from private key for faster processing; fallback to API only if local fails, reducing latency and API calls.
2. DNF Support for CentOS 8+: Replace YUM with DNF on CentOS 8 and later for improved dependency resolution and speed, with backward compatibility for older systems.
3. Ensure Supervisor runs as true PID 1 in Docker container for proper signal handling and supervision.
1. Reality Configuration Update: In Reality configurations, the original multiplexing (multiplex) has been replaced with xtls-rprx-vision flow control, improving transmission efficiency, reducing latency, and enhancing security. The original configuration conversion script command remains fully compatible and unchanged — bash <(curl -sSL https://raw.githubusercontent.com/fscarmen/tools/main/vision.sh).
2. Quick Install Mode: Added a one-click installation feature that auto-fills all parameters, simplifying the deployment process. Chinese users can use -l or -L; English users can use -k or -K. Case-insensitive support makes operations more flexible.
3. Custom Reality Key Support: In response to user feedback, you can now specify a custom Reality private key via --REALITY_PRIVATE=<privateKey>. The script will automatically compute the corresponding public key using the integrated API. If left blank, it generates a random private-public key pair in real-time.
4. Enhanced HTTP + Reality Support in Clash Clients: Added full compatibility for HTTP + Reality transport in Clash clients, improving connection stability and performance.
This commit improves the security posture for Shadowrocket, Clash, and sing-box clients by implementing certificate fingerprint validation instead of the less secure certificate skipping approach.
Key changes:
- Shadowrocket: Replaced insecure TLS validation with HPKP-based certificate fingerprint verification
- Clash: Updated configuration to use certificate fingerprints instead of skip-cert-verify flags
- sing-box: Implemented certificate_public_key_sha256 verification for enhanced TLS security
This change ensures that only connections with verified server certificates are accepted, significantly reducing the risk of man-in-the-middle attacks while maintaining compatibility with self-signed certificates.
fscarmen
