1. Add quick install mode to the menu for faster, automated setup.
2. Fix bug causing incorrect display of Nginx running status.
3. Resolve compatibility issues specific to CentOS 7 environments.
4. Introduce Nginx process startup in the guardian script for WS protocol (previo
usly unsupported due to missing Nginx dependency).
1. Reality Configuration Update: In Reality configurations, the original multiplexing (multiplex) has been replaced with xtls-rprx-vision flow control, improving transmission efficiency, reducing latency, and enhancing security. The original configuration conversion script command remains fully compatible and unchanged — bash <(curl -sSL https://raw.githubusercontent.com/fscarmen/tools/main/vision.sh).
2. Quick Install Mode: Added a one-click installation feature that auto-fills all parameters, simplifying the deployment process. Chinese users can use -l or -L; English users can use -k or -K. Case-insensitive support makes operations more flexible.
3. Custom Reality Key Support: In response to user feedback, you can now specify a custom Reality private key via --REALITY_PRIVATE=<privateKey>. The script will automatically compute the corresponding public key using the integrated API. If left blank, it generates a random private-public key pair in real-time.
4. Enhanced HTTP + Reality Support in Clash Clients: Added full compatibility for HTTP + Reality transport in Clash clients, improving connection stability and performance.
This commit improves the security posture for Shadowrocket, Clash, and sing-box clients by implementing certificate fingerprint validation instead of the less secure certificate skipping approach.
Key changes:
- Shadowrocket: Replaced insecure TLS validation with HPKP-based certificate fingerprint verification
- Clash: Updated configuration to use certificate fingerprints instead of skip-cert-verify flags
- sing-box: Implemented certificate_public_key_sha256 verification for enhanced TLS security
This change ensures that only connections with verified server certificates are accepted, significantly reducing the risk of man-in-the-middle attacks while maintaining compatibility with self-signed certificates.
fscarmen
MaxrxfandGitHub