* fix(scripts): make SSH menu config access indentation-agnostic
Running the panel built from source exposed two defects that static review
could not see, because both depend on what the Go binary actually writes to
config.yaml.
The Go binary rewrites config.yaml through a YAML marshaller. `init` emits
two-space indentation, but any later rewrite — notably `reset-config`, the SSH
rescue path — emits four, and re-sorts the keys. Every shell helper matched on
a hardcoded two-space prefix, so the menu and the binary disagreed about the
file's shape.
1. Duplicate keys after an SSH rescue
After `reset-config`, `yaml_get ' port:'` matched nothing, so the menu showed
an empty current port. `yaml_set` then took its insert branch and appended a
two-space `port:` line alongside the marshaller's four-space one:
server:
mode: release
port: 8080
sub_port: 0
port: 9090 <- inserted, duplicate
The menu then reported "Configured port: 9090" and restarted the service. The
failure mode matters more than the diff: SSH rescue is what an operator reaches
for when the panel is unreachable, which is exactly when the menu has to work.
2. `3m-ui config port <port>` left the panel unable to boot
That command hardcoded a two-space indent, producing mixed indentation inside
one block:
server:
mode: release
port: 19090
public_url: ""
The binary then refuses to start at all:
failed to decode config YAML: yaml: line 12: did not find expected key
This command is documented in the README, so following the documentation
bricks the panel.
Both are fixed the same way: key lookup is now indentation-agnostic (matched
on $1 rather than a fixed prefix, which also removes any ambiguity between
`port:` and `sub_port:`), replacement preserves the indentation of the line it
rewrites, and insertion adopts the block's existing indent. Callers pass
"port:" instead of " port:".
Also fixed: menu item 17 (Healthcheck) produced no output at all, because the
binary's healthcheck exits 0 silently on success. It now reports pass/fail
based on the exit status.
Verified against a panel compiled from source and running on loopback:
rescue -> change port -> restart yields a single `port:` key with consistent
indentation, config stays 0600, the panel serves HTTP 200, and the healthcheck
item reports OK. The regression script (scripts regression, 16 cases) covers
both defects by reproducing them against the old implementation first.
* fix(scripts): make SSH menu config access indentation-agnostic
Running the panel built from source exposed two defects that static review
could not see, because both depend on what the Go binary actually writes to
config.yaml.
The Go binary rewrites config.yaml through a YAML marshaller. `init` emits
two-space indentation, but any later rewrite — notably `reset-config`, the SSH
rescue path — emits four, and re-sorts the keys. Every shell helper matched on
a hardcoded two-space prefix, so the menu and the binary disagreed about the
file's shape.
1. Duplicate keys after an SSH rescue
After `reset-config`, `yaml_get ' port:'` matched nothing, so the menu showed
an empty current port. `yaml_set` then took its insert branch and appended a
two-space `port:` line alongside the marshaller's four-space one:
server:
mode: release
port: 8080
sub_port: 0
port: 9090 <- inserted, duplicate
The menu then reported "Configured port: 9090" and restarted the service. The
failure mode matters more than the diff: SSH rescue is what an operator reaches
for when the panel is unreachable, which is exactly when the menu has to work.
2. `3m-ui config port <port>` left the panel unable to boot
That command hardcoded a two-space indent, producing mixed indentation inside
one block:
server:
mode: release
port: 19090
public_url: ""
The binary then refuses to start at all:
failed to decode config YAML: yaml: line 12: did not find expected key
This command is documented in the README, so following the documentation
bricks the panel.
Both are fixed the same way: key lookup is now indentation-agnostic (matched
on $1 rather than a fixed prefix, which also removes any ambiguity between
`port:` and `sub_port:`), replacement preserves the indentation of the line it
rewrites, and insertion adopts the block's existing indent. Callers pass
"port:" instead of " port:".
Also fixed: menu item 17 (Healthcheck) produced no output at all, because the
binary's healthcheck exits 0 silently on success. It now reports pass/fail
based on the exit status.
Verified against a panel compiled from source and running on loopback:
rescue -> change port -> restart yields a single `port:` key with consistent
indentation, config stays 0600, the panel serves HTTP 200, and the healthcheck
item reports OK. The regression script (scripts regression, 16 cases) covers
both defects by reproducing them against the old implementation first.
* test(scripts): add regression coverage for the SSH menu config helpers
The existing lifecycle tests exercise install.sh end to end but never touch
the menu's config read/write path, which is where both defects in the previous
commit lived. This adds 16 cases.
Each case runs the pre-fix implementation and the fixed one against the same
input and asserts both directions: the old one must reproduce the defect, the
new one must not exhibit it. A case whose "before" assertion passes is scored
FAIL — otherwise the suite could go green without ever having exercised the
bug.
Covers: block-scoped writes, 0600 preservation, `config port` with a missing
argument, the self-referencing entrypoint loop, insertion placement, missing
`server:` block, indentation-agnostic lookup, and indentation consistency.
The suite is self-contained: it needs no installed panel, writes only to a
temp dir, and the one case that touches /usr/local/bin/3m-ui skips itself if
that path already exists.
* fix(scripts): scope SSH menu config writes to the server: block
The SSH management menu edited /etc/3m-ui/config.yaml with a global sed
substitution, which rewrote every identically-indented key in the file rather
than just the panel's. Changing the panel port therefore also rewrote unrelated
listener ports, and because the menu restarts the service right afterwards the
corruption went live immediately.
The same code path wrote the new file with `mv`, so a 0600 config holding the
JWT and credential-encryption keys came back as a umask-default 0644 file,
readable by every local user after any port or path change.
Both are fixed by scoping reads/writes to the `server:` block and by writing
back through the original inode (`cat > file`) instead of replacing it.
Three further defects found while auditing the menu:
- scripts/3m-ui.sh: `config port` read a bare "$2" under `set -u`, so running
it without an argument aborted with "parameter not set" and the usage
message below it was unreachable. Now "${2:-}".
- scripts/3m-ui.sh: the no-arg branch exec'd /usr/local/bin/3m-ui without
checking whether it resolves back to this script, which spun in an endless
exec loop on a broken entrypoint. Direct and indirect self-reference are now
detected and reported with an actionable message.
- scripts/3m-ui: `enable_bbr` wrote into /etc/sysctl.d without creating it; on
minimal/container images the redirect failed and `set -e` tore down the whole
interactive menu. Now mkdir -p with a guarded failure.
Hardening and consistency:
- yaml_set reports an error instead of silently no-oping when neither the key
nor a `server:` block exists; the menu no longer restarts the service for a
change that never happened.
- yaml_get is scoped to the `server:` block so it matches yaml_set.
- temp files come from mktemp (0600) instead of a predictable .$$ name.
- open_firewall asks for confirmation before opening 22/80/443.
- status reports boot-time enablement on OpenRC, not only systemd.
- menu item 8 reports invalid input instead of returning silently.
- menu item 23 is relabelled: it updates all of 3m-ui, not only the script.
- the acme.sh helper is annotated as an example to review before running.
Verified locally: the listener port is left untouched when the panel port
changes, config mode stays 0600, `config port` with no argument prints usage,
the self-referencing entrypoint fails fast instead of looping, and both files
pass `sh -n`.
* fix(scripts): scope SSH menu config writes to the server: block
The SSH management menu edited /etc/3m-ui/config.yaml with a global sed
substitution, which rewrote every identically-indented key in the file rather
than just the panel's. Changing the panel port therefore also rewrote unrelated
listener ports, and because the menu restarts the service right afterwards the
corruption went live immediately.
The same code path wrote the new file with `mv`, so a 0600 config holding the
JWT and credential-encryption keys came back as a umask-default 0644 file,
readable by every local user after any port or path change.
Both are fixed by scoping reads/writes to the `server:` block and by writing
back through the original inode (`cat > file`) instead of replacing it.
Three further defects found while auditing the menu:
- scripts/3m-ui.sh: `config port` read a bare "$2" under `set -u`, so running
it without an argument aborted with "parameter not set" and the usage
message below it was unreachable. Now "${2:-}".
- scripts/3m-ui.sh: the no-arg branch exec'd /usr/local/bin/3m-ui without
checking whether it resolves back to this script, which spun in an endless
exec loop on a broken entrypoint. Direct and indirect self-reference are now
detected and reported with an actionable message.
- scripts/3m-ui: `enable_bbr` wrote into /etc/sysctl.d without creating it; on
minimal/container images the redirect failed and `set -e` tore down the whole
interactive menu. Now mkdir -p with a guarded failure.
Hardening and consistency:
- yaml_set reports an error instead of silently no-oping when neither the key
nor a `server:` block exists; the menu no longer restarts the service for a
change that never happened.
- yaml_get is scoped to the `server:` block so it matches yaml_set.
- temp files come from mktemp (0600) instead of a predictable .$$ name.
- open_firewall asks for confirmation before opening 22/80/443.
- status reports boot-time enablement on OpenRC, not only systemd.
- menu item 8 reports invalid input instead of returning silently.
- menu item 23 is relabelled: it updates all of 3m-ui, not only the script.
- the acme.sh helper is annotated as an example to review before running.
Verified locally: the listener port is left untouched when the panel port
changes, config mode stays 0600, `config port` with no argument prints usage,
the self-referencing entrypoint fails fast instead of looping, and both files
pass `sh -n`.
Empty/missing jls-upstream caused whole config reload to fail and left
new listeners stuck as config_not_applied. Autofill defaults and ensure
addr/sni when compiling shadowquic listeners.
yaml:"-" dropped the subscription dial flags on save so UI switches
reset after refresh. Store as client-tfo/client-mptcp and strip them
when merging the visual fragment into the serving Mihomo YAML.
- Remove mode from Config general settings UI
- Client proxies only emit wiki tfo/mptcp booleans; strip inbound-* and
other server-only keys from subscription YAML
- OpenAPI SSL engine notes match current acmez stack
* feat(proxy): expose per-proxy tfo / mptcp (TCP Fast Open / Multipath TCP)
Add Mihomo's proxy-level `tfo` and `mptcp` options (wiki.metacubex.one/config/proxies)
to the panel so clients can opt into TCP Fast Open / Multipath TCP on a per-node basis.
Mapping accuracy:
- These are PROXY-level keys, distinct from the global `inbound-tfo` / `inbound-mptcp`
general switches. They travel through ProxyEntry.Options (the same catch-all that already
feeds both the serving config and the client subscription document), so they surface in
BOTH the server mihomo config and the generated client subscription config — no field is
lost or misrouted.
Frontend (web + mobile share the same Config page / responsive Modal):
- Proxy editor gains TFO (TCP Fast Open) and MPTCP (Multipath TCP) switches.
- An info note states they only take effect on TCP transports.
- Modal body becomes scrollable on phones (maxHeight 78vh) so the added rows stay reachable
on small screens; width/top already adapt via useIsMobile.
i18n: zh-CN / en strings for proxyTfo, proxyMptcp, proxyTcpOnly.
Tests:
- config: tfo/mptcp serialize into proxy YAML and round-trip; absent stays absent, explicit
false is preserved.
- converter: client subscription document preserves tfo/mptcp from visual proxies.
* fix(i18n): add missing commas after proxy TFO/MPTCP keys
---------
Co-authored-by: 3m-ui dev <dev@local>
Co-authored-by: kazeyukiro <kazeyukiro@users.noreply.github.com>
* feat(config): add inbound-tfo / inbound-mptcp global kernel settings
Expose Mihomo's top-level `inbound-tfo` and `inbound-mptcp` general keys
(TCP Fast Open / Multipath TCP applied to every inbound listener socket) in
the panel. These are GLOBAL switches, not per-listener fields, so they are
carried on VisualConfig — the same struct that feeds the serving Mihomo
config fragment — and never copied into client subscription documents.
Backend:
- VisualConfig gains InboundTfo / InboundMPTCP (json inboundTfo/inboundMptcp,
yaml inbound-tfo/inbound-mptcp), matching Mihomo's exact key names.
- MihomoConfig gains the same keys (omitempty) for schema completeness.
- GenerateFinalConfig already merges the visual-config fragment over the
template (only listeners/rules/proxies/groups are stripped), so the keys
surface in the serving config exactly as Mihomo expects.
Frontend:
- Config page gains a 'General' card (mode, log level, allow-lan, ipv6,
inbound-tfo, inbound-mptcp) loaded from /config/visual and saved via
POST /config/visual. The full VisualConfig is preserved on save so existing
proxies/groups/rules/DNS are not clobbered.
- i18n zh-CN / en strings added.
Tests:
- config package tests assert inbound-tfo / inbound-mptcp appear as `true`
in GenerateFinalConfig output when enabled and never become `true` when off.
* fix: gofmt visual.go; type saveVisualConfig payload as VisualConfig
---------
Co-authored-by: 3m-ui dev <dev@local>
Co-authored-by: kazeyukiro <kazeyukiro@users.noreply.github.com>
The port Form.Item had both a `required` rule and a custom validator
that rejected on empty with the same message. AntD renders every failed
rule, so an empty port produced the identical "Port is required"
message twice.
Let `required` own the empty case and have the validator only check the
format (returning early on empty). Add `whitespace: true` so a
spaces-only value still counts as empty.
Co-authored-by: 3m-ui dev <dev@local>
PR #91 made the creation-time guards (ensureEndpointAvailable,
ensureBatchEndpointsAvailable) transport-aware so a TCP listener and a UDP
listener can share an address:port. But the third copy of the conflict check
inside Mihomo config generation — validateListenerEndpoints in
internal/mihomo/config/generator.go — was left untouched. So a TCP+UDP pair
that creation now permits was still rejected when the panel regenerated the
Mihomo config, surfacing as:
warning: Mihomo config generate after listener change failed: ...
listeners "节点2" and "节点5" have conflicting bind address/port ranges
(0.0.0.0:16201 and 0.0.0.0:16201)
Make validateListenerEndpoints reuse protocol.ListenerTransports and only flag
a conflict when the two listeners share an L4 transport, matching the
creation-time guard. Same-protocol pairs on the same address:port still
conflict.
Tests:
- TestValidateListenerEndpointsAllowsTCPandUDPOnSamePort
- TestValidateListenerEndpointsRejectsTwoTCPOnSamePort
- TestValidateListenerEndpointsRejectsTwoUDPOnSamePort
Co-authored-by: 風雪 <kazeyukiro@users.noreply.github.com>
The in-app "Download backup" button exported the SQLite file with a plain
`os.Open` + `io.Copy` while the panel's GORM pool was still open and writing.
That copy races with concurrent writes (torn pages) and, even after the prior
WAL checkpoint, could leave committed frames in -wal that the copy never
replayed — an inconsistent or partially-lost backup.
Replace the checkpoint + file copy with SQLite's online backup primitive
VACUUM INTO, which reads through the WAL and in-flight transactions to produce
a self-contained, fully-replayed snapshot without stopping the panel.
Also stop bundling 3m-ui.db-wal / 3m-ui.db-shm into the zip. The VACUUM INTO
result is already complete (WAL merged in), so the sidecars were dead weight —
and they were never restored on import anyway, which silently dropped
un-checkpointed writes on restore.
Tests:
- TestWriteZipSnapshotIsConsistentAndSelfContained: a WAL-mode db with 200 rows
held open by a live connection; WriteZip produces a zip whose 3m-ui.db opens
standalone with all 200 rows and contains no -wal/-shm entries.
- go vet + go test -tags sqlite_modernc ./... green.
Co-authored-by: 風雪 <kazeyukiro@users.noreply.github.com>
The endpoint conflict guard in ensureEndpointAvailable (and its batch
counterpart ensureBatchEndpointsAvailable) compared only port ranges and
bind addresses — it never looked at the L4 protocol. A TCP listener on
443 and a UDP listener on 443 are independent sockets at the OS level and
Mihomo serves both fine, but 3m-ui rejected the second one with
"conflicts on 0.0.0.0:443". So you could not run e.g. VLESS (TCP) and
TUIC/Hysteria2 (UDP) on the same port.
Add protocol.ListenerTransports, which maps a listener's protocol kind to
the L4 transport(s) its inbound binds (UDP for tuic / hysteria /
hysteria2 / shadowquic / mieru; TCP for everything else). The proxy `udp`
toggle is UDP relay over an established connection and is intentionally
ignored — it does not open a UDP listening socket. The conflict check now
also requires the two listeners to share an L4 transport, so a TCP+UDP
pair on the same address:port no longer collides while two TCP or two UDP
listeners still do.
Tests:
- protocol.ListenerTransports unit tests (udp/tcp/case-insensitive).
- listener.listenersShareTransport unit tests.
- End-to-end: a TCP+UDP pair on 443 coexists and the UDP listener stays on
443 through Create (it is not silently reassigned to a free port), while
two TCP or two UDP on 443 still conflict.
Co-authored-by: 風雪 <kazeyukiro@users.noreply.github.com>
The create/edit listener form set the port field's `tooltip` and its
`required`/format validation `message` to the same i18n key (`portHint`).
When the field was empty or malformed, the identical "监听端口（wiki:
port）。单端口或官方 ports 语法。" string showed up twice — once as the
hover help and once as the red validation error — which read as two
duplicate hints.
Split the validation copy out of the help string: `portRequired` for the
empty case and `portFormat` for the syntax case, while `portHint` stays
purely as the hover help. The "ports syntax" phrasing itself is correct
per the Mihomo listener docs (port supports single port or
comma/hyphen ranges), so only the duplication is fixed.
Co-authored-by: 風雪 <kazeyukiro@users.noreply.github.com>
Replace golang.org/x/crypto/acme/autocert domain HTTP-01 with
domainHTTPIssuer (acmez + scheduled renew). DNS-01 and IP already used
acmez. PEM cache: http-<domain>.crt/.key; auto-renew ~30d before expiry.
No panel-hosted rule-sets. Remote MetaCubeX geosite (cn/apple@cn/…) and
cn_ip via cdn.jsdelivr.net; DNS Ali for CN, Google DoH via proxy otherwise.
Remove embedded .srs and /client/rule-set routes.
Embed geosite-cn.srs / geoip-cn.srs and serve them at
/api/v1/client/rule-set/*.srs on the same host as the subscription.
Subscription stays small for SFI while domain+IP CN coverage is complete.
Remove multi-MB inline domain/IP dumps that broke mobile clients.
風雪