2 Commits

Include renames

Author	SHA1	Message	Date
風雪	39608cd0fb	fix(infra): fail-closed checksums, sandbox hardening, non-root Docker ... Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.'	2026-08-29 09:39:25 +00:00
風雪	4d6241740d	feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring ... Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts.	2026-08-19 14:15:52 +00:00