Backpack v1.6.5

The panel is checked from a phone more often than from a desktop, so it installs
as one now. Getting there needed a certificate, which needed a terminal — that
is a Settings screen too. And the release before this one shipped a broken brace
that quietly emptied the Health Check.

Fixed

• Health Check and Alerts came up empty. Both write their rows and then ask
  the page to re-translate itself, and applyLang assigns textContent to
  every element marked data-i18n — including the containers those rows had
  just been written into. The results were overwritten by the placeholder the
  markup shipped with, in the same tick they arrived. The hostname in the header
  was being reset the same way between polls.
• The accent picker multiplied. A merge had joined function relang(){ to
  the comment that opened the accent section, so the closing brace ended up
  sixty lines further down and the whole block — the palette, the swatch builder
  and a GitHub request — became the body of a function called on every render.
  Six swatches became twelve, then eighteen, depending on how many panels you
  had opened. It also meant none of it ran on page load.
• Settings toggle labels sat under their switch instead of beside it.
  .modal label sets display:block and outranks a bare .tg, so the flex row
  never applied inside Settings. Invisible while the control was a small
  checkbox; obvious once it became a 40px switch.
• Location and ISP were usually blank. The public address was resolved once,
  behind a sync.Once, and the panel starts from systemd at boot — often before
  the network is up. One failed lookup then stuck for the life of the process,
  and the geo lookup that depends on it never had anything to work with. Both
  are now refreshed in the background, retried while incomplete, and never block
  a request.
• Changing the panel port redirected to http:// even when the panel was
  serving HTTPS.

Added

• Install the panel as an app. A service worker, a proper manifest and real
  bitmap icons — including a maskable one for Android and a PNG for iOS, which
  ignores SVG for a home-screen icon. On a phone or tablet the panel offers to
  add itself once: one tap where the browser supports it, the Share-menu steps
  on iOS where it does not. The worker caches nothing on purpose — this is a
  live dashboard behind a login, and a cached reading of a server is a wrong one
  — so it exists for installability and answers a failed page load with an
  offline card.
• Panel certificate, in the panel. Settings → Panel access → Certificate,
  with the same three choices as the CLI. Let's Encrypt is only offered when it
  could actually succeed: the panel checks that the domain resolves to this
  server and that a validation route exists (port 443 for TLS-ALPN, or a free
  port 80 for HTTP-01), and refuses with the reason when it does not. Getting
  that wrong restarts the panel onto a listener that can never complete a
  handshake, and whoever pressed the button has a browser and no shell.

Changed

• Total traffic is the sum of the tunnels, not the machine's interface
  counters. It is now exactly the total of what the cards show, rather than a
  larger figure including ssh, apt and the panel itself — and it survives a
  reboot, which the interface counters do not. Up and down speed still come from
  the interface: that answers what the box is doing now.
• The health pass probes tunnels concurrently. Sequentially, a client tunnel
  whose server is down cost the full four-second timeout each, and enough of
  them ran past the panel's 30-second write timeout — cutting off the response
  mid-flight.

Backpack v1.6.3

The panel gets a clear-out. The header carried six facts nobody reads twice,
the tile row carried eight figures to answer four questions, and the menu would
not close. All of that is smaller now, the accent colour is yours to pick, and
the panel can serve itself over HTTPS.

Fixed

• A server card never showed its own tunnel port. The field was declared,
  documented, and never once assigned, so every card printed a dash where the
  port belongs — the one number on a card that cannot be found anywhere else on
  the page.
• The menu would not close when you clicked away from it. Its backdrop asked
  to cover the viewport and covered only the header, because the header carries
  a backdrop-filter and a filtered element becomes the containing block for
  anything positioned against the viewport inside it. Nothing about the CSS
  looked wrong. The menu and its backdrop live outside the header now, which
  also fixes the full-width sheet on phones — mispositioned by the same trap,
  and not previously noticed.
• A connection limit leaked a slot on every timeout. A forwarded connection
  that waited more than three seconds to be paired was closed without releasing
  the slot it took on accept; only the handler frees that, and the handler never
  runs for a connection that timed out. Tunnels with max_connections set would
  fill up permanently. Tunnels with no limit were never affected.

Added

• Pick the accent colour. Six of them — Ember (the CLI's own, and the
  default), Pomegranate, Saffron, Pistachio, Turquoise and Frost — in Settings
  beside Language. Every coloured thing in the panel derives from one variable,
  so a theme is that variable and nothing else, and the login screen follows the
  same choice: it is the first thing anyone sees, and a sign-in page in a colour
  the panel does not use reads as a different product.
• HTTPS for the web panel, under Web Panel → Certificate in the CLI. A
  self-signed certificate works anywhere, including on the bare IP most of these
  panels live on, and the browser warns once. With a domain that resolves here
  and port 80 reachable, Let's Encrypt issues one browsers trust and renews it
  on its own — the certificate is resolved per handshake, so a reissue lands
  without restarting the panel. Off by default, and it stays off on upgrade:
  turning it on changes the address people have bookmarked, so it is a
  deliberate act rather than something an update does to you.
• GitHub, with its star count, in the menu. Fetched by the browser so it
  works from a panel on a server with no internet of its own, cached for six
  hours because GitHub allows sixty anonymous requests an hour, and simply left
  off when it cannot be had.
• A prompt asking for a star, shown at most once every three days, never on a
  first visit, and never again after either answer. This panel also carries the
  alerts, and anything that teaches people to dismiss it without reading costs
  more than a star is worth.

Changed

• The header carries the brand and the way in, and nothing else. Uptime,
  the addresses, OS, location and ISP all moved into the menu: they are read
  when a server is set up and then almost never again, which does not earn a
  permanent strip across the top of every screen.
• The tile row went from eight to four: download, upload, one total, and the
  running version. In and out were two tiles answering half a question each —
  "how much has this machine moved" is the question, so it is one figure now.
  Load and the tunnel count were already on screen elsewhere, and the congestion
  algorithm is a setup detail, so it joined the rest of the machine's facts in
  the menu.
• A tunnel's status is a ring around its whole card, drawn inside the edge,
  instead of a bar down one side. The same three pixels, now describing the card
  they belong to, breathing on the status dot's rhythm — identical duration and
  identical keyframes, so the two read as one signal rather than two things
  blinking near each other.
• Traffic on a card is one line — ↓ 203.5 GiB ↑ 13.0 GiB Σ 216.6 GiB —
  with the glyphs quiet and the figures bright. Dropping the label and the
  pairing slash bought the total, which is what most people were adding up in
  their head.
• Support Backpack left the menu. The heart button already floats in the corner
  of every screen, and asking twice is not asking better.

Notes

No config, wire protocol, or tunnel behaviour changes. Updating replaces the
binary.

Backpack v1.6.1

A hotfix. Tunnels updated to v1.6.0 came up, held a good ping, and then carried
nothing: sites and applications would not open through them.

Fixed

• Forwarded connections stopped carrying data. v1.6.0 added a zero-copy path
  to the forwarded relay — between two ordinary sockets, the kernel moved the
  bytes itself instead of them passing through this process. It is reverted. The
  relay is byte-for-byte the loop the upstream project uses, which is the
  behaviour proven on real tunnels; the optimisation was worth CPU on the plain
  TCP transport and nothing else, and it was the only place the forwarded data
  path had diverged. The traffic counting that existed only to serve it is gone
  with it, back to counting each read and write.

  Speed is unaffected: the ceiling is set by the mux stream window and the KCP
  window, which this never touched. Every performance preset behaves exactly as
  it did.

• A connection limit leaked a slot on every timeout. A forwarded connection
  that waited more than three seconds for a tunnel connection to pair with was
  closed without releasing the slot it took when it was accepted — only the
  handler frees that, and the handler never runs for a connection that timed
  out. On a tunnel with max_connections set, the limit filled up permanently
  until it would accept nothing at all. Tunnels with no limit configured were
  never affected, because the limiter does not count at all when it is unlimited.

Notes

No config, wire protocol, or tunnel behaviour changes. Updating replaces the
binary.

Backpack v1.5.5

A monitoring release: the web panel grows from a live snapshot into something
that remembers, and two bugs that made a KCP tunnel look broken are fixed.

Fixed

• Real client IP over KCP dropped every forwarded connection. With the
  real-client-IP option on, the server prepends a PROXY protocol v2 header to
  each connection — and to build it, the code cast the outbound tunnel
  connection to a TCP address. On the datagram transports that connection is a
  UDP socket, so the cast failed, the header was never written, and the
  connection was closed before a byte moved. The tunnel connected, the control
  channel came up, and then nothing crossed it — the log filled with
  destination connection address is not a TCP address. The header now takes
  its destination from the forwarded listener the client actually connected to,
  which is a TCP address on every transport, so KCP (and raw UDP) carry the
  real client IP like the rest. There is an end-to-end test exercising the
  PROXY header over every transport that supports it, which is the coverage
  that was missing when the bug shipped.
• KCP and UDP client tunnels showed as offline in the panel, with no ping.
  The panel probed a client tunnel by opening a TCP connection to the server's
  port. A KCP or UDP server listens on a UDP port, so that probe always
  failed — and the panel then marked a working tunnel offline and showed no
  latency. The datagram transports are now judged by the same socket check the
  watchdog uses (never by a TCP probe), and their latency comes from a
  best-effort ICMP ping that can be blank without ever implying the tunnel is
  down.

Added

• The panel remembers now. A per-tunnel sparkline shows the last few
  minutes of throughput on each card, and Details carries the longer view:
  a 24-hour speed chart, per-day totals for the week, and an uptime
  percentage for the last day and week. The history is sampled every five
  minutes by the monitoring service and kept for a month, so it survives a
  panel restart — the sparkline answers "what is happening now", this answers
  "what happened this week".
• Health Check in the panel (the bell-and-graph button): the same screen as
  the CLI's Health Check — server tuning, the monitor service, the panel, and
  every tunnel — with a ✓ / ! / ✗ and a plain-language fix per item, read-only.
• Link Test in the panel (Details → Link Test): measures latency, jitter
  and packet loss to the server over TCP and recommends a transport, the same
  as the CLI. It runs on a client tunnel, where there is a server to measure.
• Alerts view (the bell): what the monitoring service has fired — the
  conditions active right now and the recent messages, the same source as the
  Telegram alerts. A dot on the bell marks a live alert. Alerts are now recorded
  even when the Telegram bot is not configured, and the watchdog writes a line
  here every time it restarts a dropped tunnel.
• Fuller tunnel Details. Traffic in and out, uptime, performance preset,
  per-tunnel limits, the certificate (self-signed or Let's Encrypt, with its
  expiry), PROXY protocol, and the failover/backup addresses — all read from
  the tunnel's own config and metrics.
• The panel warns when the monitor is down, and shows a notice when a newer
  release is out — both from the background check, so nothing on the display
  path waits on the network.
• Prometheus metrics at /metrics (system, per-tunnel traffic and state,
  and the KCP link-quality counters), reachable with a read-only access token
  minted under Settings → Remote access — for anyone running Grafana across
  several servers.
• Weekly automatic backup, taken by the monitoring service into the standard
  backups folder and pruned like a manual one — Settings → Backup.
• Restore points are listed in the panel (Settings), read-only; a
  rollback stays a CLI decision because it replaces the running binary.
• Login hardening. Five failed logins from one address earn a ten-minute
  lockout; an optional two-factor step sends a code through the Telegram bot
  after the password; an optional login alert messages you on every sign-in
  with the address; and Settings lists signed-in devices with a per-device
  revoke and "sign out everywhere".
• The panel is installable as an app (a web manifest and icon), so it can be
  added to a phone's home screen — the usual way this dashboard gets checked.
• Release channel and log tools in the panel: switch stable/beta under
  Settings → Update, and filter the log drawer with ERROR/WARN lines
  highlighted.

Backpack v1.5.0

Added

• New transport: TCP + Stealth. A TCP tunnel wrapped in an encrypted record layer
  (Noise, NNpsk0) that has no handshake to fingerprint — on the wire it is
  two short bursts of what looks like random data, followed by an encrypted
  stream that looks the same. There is no TLS ClientHello and no recognisable
  protocol for deep packet inspection to match against, which is the failure
  mode the TLS-based transports are increasingly hitting on filtered routes.

  The pre-shared key is derived from the tunnel token, so the transport needs no
  key of its own, and because that key is mixed in from the very first message,
  a peer without the token cannot produce a message the server will accept: it
  is dropped with no reply, so a probe or a port scan finds a dead port rather
  than a service to fingerprint. It carries TCP like the plain transport — PROXY
  protocol, per-tunnel limits and metrics all apply — with slightly more CPU for
  the encryption. Pick it under Setup → Stealth, or switch an existing tunnel
  to it from Edit. Reach for it where filtering is heavy; TCP Mux or WSS
  remain the lighter choice on an open route.

• WSS and WSS Mux now send a browser TLS fingerprint. A WSS tunnel is meant
  to look like ordinary HTTPS, and at the HTTP layer it already did — a real
  User-Agent, a plausible path. But the TLS ClientHello underneath was Go's, and
  Go's ClientHello has a fingerprint of its own (its cipher list, its curves, the
  order of its extensions) that filtering can pick out even when everything above
  looks right. The handshake now carries the fingerprint of a current Chrome
  build instead, so it blends into ordinary browser traffic. Nothing above TLS
  changes, and trust is unchanged — the certificate is still not verified,
  because the tunnel authenticates with its token. It applies automatically to
  every wss/wssmux tunnel; there is nothing to configure. (Where Stealth
  looks like nothing, this looks like a browser.)

• New transport: UDP + KCP — a reliable, retransmitting protocol inside UDP
  datagrams, with forward error correction: for every 10 packets it sends 3
  (or 4) parity packets, so losses are repaired instantly instead of waiting a
  full round trip for a retransmit. This is the transport to use when the route
  loses packets and TCP keeps backing off. Datagrams are encrypted with a key
  derived from the tunnel token.

  KCP runs over UDP. If your provider filters UDP it will not help — test
  before committing to it.

• Real client IP (PROXY protocol v2). The service behind the tunnel normally
  sees every connection as coming from the tunnel itself, so a VPN panel counts
  all users as one device and per-user device limits stop working. Turning this
  on prefixes each forwarded connection with a PROXY protocol v2 header carrying
  the user's real IP and port. Available on TCP, TCP Mux, KCP, WS Mux and WSS Mux
  (the plain websocket and raw UDP transports have nowhere to put it). Off by
  default, and the backend must be set to accept it first — otherwise it reads
  the header as traffic and every connection breaks.

• Performance presets: Balance, Turbo and Aggressive, applied to every
  transport instead of the old yes/no "Best Performance" question.

  • Balance — light on CPU and RAM, for a small or shared VPS.
  • Turbo — the recommended default. It is byte-for-byte identical to the
    old Best Performance preset, so upgrading changes nothing about an
    existing tunnel.
  • Aggressive — maximum throughput and noticeably more CPU.

  A tunnel's preset can be changed later from Edit → Change performance
  preset. Configs written before this release carry no preset field and are
  left exactly as they are.

• Link Test (Manage → Link Test): measures latency, jitter and packet
  loss to the far server over TCP (never ICMP — many networks on this route drop
  ping while carrying tunnel traffic fine), then recommends a transport and
  explains why: KCP when the link loses packets, TCP Mux when it is jittery or
  clean, WSS when nothing answers at all. It also derives liveness timers
  from the measured round trip instead of the fixed 75s/40s defaults, and offers
  to apply them.

• Load balancing across backup addresses. Previously the backup addresses
  were only spares. With balancing on, the tunnel's data connections are spread
  over all of them at once, so a single throttled route slows only its own share
  of the traffic. The control channel stays pinned to one address, since it is
  what identifies the peer. Every address must reach the same server — a
  second IP of it, another of its ports, or a CDN edge in front of it.

• Setup menus are grouped by transport family — TCP, UDP and WebSocket —
  so the choice is made in two short steps instead of one long list.

• Per-tunnel limits. A cap on simultaneous forwarded connections and a cap
  on total throughput, for when several services or customers share one link and
  none of them should be able to take all of it. Both off by default —
  Edit → Limits.

• Structured JSON logging (log_format = "json"), for anyone feeding these
  logs to a collector or a script. The default stays human-readable, since the
  usual reader is a person running journalctl.

• You get told when a new version is out. The CLI shows a line under the
  logo — and marks the Update entry — as soon as a newer release exists, and the
  Telegram bot messages you once per version.

  The check runs in the background and its answer is cached on disk, so nothing
  on the display path ever waits for GitHub: the menu cannot stall on a redraw,
  which matters on a route where the request may fail over through several
  mirrors first. A failed check leaves the previous answer in place rather than
  erasing it. The "already announced" mark is stored on disk too, so restarting
  the panel does not re-announce a version you have already been told about, and
  the notice clears itself once the update is applied. Switch it off under
  Telegram Bot → Alerts.

• Telegram alerts. The bot no longer only answers when asked — it messages
  you on its own when the processor, memory or disk crosses a threshold, and
  when a tunnel goes down or comes back. Every alert has a matching recovery
  message, because knowing a problem started is only half of it.

  Two things keep it from becoming noise, which is what makes people mute a
  monitoring bot and then miss the outage that mattered. A reading has to fall
  clearly below its threshold before the alert clears, so a value hovering on
  the line produces one message rather than dozens; and a condition that
  persists is repeated at most once per cooldown. The first pass after a restart
  only records tunnel state instead of announcing all of it.

  Defaults: processor 85%, memory 85%, disk 90%, tunnel up/down on, checked
  every 60s, repeated at most every 30 minutes. Existing installs get these on
  upgrade — a bot that never warns you is the thing being fixed — and all of it
  is editable under Telegram Bot → Alerts, where 0 turns a threshold off.
  Alerts are watched by the backpack-monitor service (see below), which runs
  independently of the web panel.

• The Telegram bot reports much more. Alongside Status it now has System
  (processor, memory, disk, swap, load and uptime, with bars), Tunnels
  (per-tunnel state, including whether the peer is really connected rather than
  just whether systemd is happy), Metrics (traffic, packet loss and FEC
  repairs) and Alerts. Everything is reachable both as a button and as a
  command — /status, /system, /tunnels, /metrics, /alerts, /webui,
  /help — and the two share one implementation, so they cannot drift apart.

• Let's Encrypt certificates for wss and wssmux (Edit → Certificate).
  Self-signed stays the default, because it works on a bare IP and most setups
  have no domain.

  The reason to want a real one is not encryption — the client is Backpack's own
  code and does not verify the certificate either way. It is how the connection
  looks from outside: genuine HTTPS on port 443 is never self-signed, so a
  self-signed certificate is a distinguishing mark on a route where being
  distinguishable is the whole problem. A real one removes it, and a CDN in
  front of the tunnel requires one.

  Validation works over the tunnel's own listener when it is on port 443
  (TLS-ALPN), so usually nothing extra needs opening; otherwise an HTTP-01
  responder runs on port 80. Renewal is automatic and needs no restart — the
  listener asks for the current certificate per handshake rather than holding
  the one it started with. The CLI checks that the domain resolves to this
  server before saving, so a typo is caught while the old certificate is still
  in place rather than after a restart.

• Tunnel Metrics (Manage → Tunnel Metrics): traffic and connection
  counts per tunnel, and for KCP the numbers that actually explain a slow link —
  retransmits, lost and duplicated segments, and how many packets forward
  error correction repaired. That last one is the direct answer to "is KCP
  earning its overhead on my route?"

• Release channels. The updater can follow stable (default) or beta,
  so pre-releases can be tested without being pushed to everyone. Switch under
  Update → Release channel.

• Downloaded releases are checksum-verified. The installer and the updater
  both check the asset's SHA-256 against the published SHA256SUMS before
  installing it, and refuse to install anything they cannot verify — see
  Security below.

• The Telegram bot picks its own way out, and re-picks it when that breaks.
  Reaching Telegram fro...

Backpack v1.4.0

Backpack v1.4.0

Install / update: bash <(curl -fsSL https://raw.githubusercontent.com/AminMGMT/BackPack/main/install.sh) — or press Update in the CLI menu. This release updates itself safely: it saves a restore point first and rolls back on its own if anything fails to come back up.

Added

Automatic failover to backup server addresses
A client tunnel can now hold extra server addresses — a second IP, a different port, or a CDN edge. When the main address stops answering (a filtered IP, a blocked port), the client rotates to the next one automatically until something connects, and every data connection follows it. This is what keeps a tunnel alive after a server IP gets filtered, without you touching the server.
Set it up during Setup Client, or later from Manage → Manage Tunnels → Edit → Backup server addresses (1.2.3.4, 5.6.7.8:8443, edge.example.com:443 — a bare IP reuses the main port). A tunnel with a single address behaves exactly as before.

Safe updates with automatic rollback
Every update now saves a restore point (the binary plus every config), installs the release, then health-checks the panel and all tunnels. If anything fails to come back up, the previous version is restored automatically. Restore points are also listed under Update → Restore points so you can roll back whenever you want.

Safe edits with automatic revert
Changing a port, address or transport keeps the previous config, verifies the tunnel actually came back up, and reverts automatically if it did not — telling you why, straight from the log (e.g. "address already in use"). A bad edit can no longer leave you with a dead tunnel and a lost config.

Change transport on an existing tunnel
Switch between tcp / tcpmux / udp / ws / wss / wsmux / wssmux without recreating anything: the name, token and forwarded ports stay as they are, mux settings are filled in, and a TLS certificate is generated automatically when moving to wss/wssmux. (Switch the other side to the same transport too.)

Health Check — Manage → Health Check
One screen that checks everything and tells you how to fix what's wrong:

• Server: BBR, queue discipline, socket buffers, open-file limit, binary, root, systemd
• Web panel: service, port listening, firewall hint
• Every tunnel: state, listening port, port syntax, real TCP reachability, TLS certificate expiry, token strength

Each item gets a ✓ / ! / ✗ and every problem gets a plain-language fix underneath.

File Locations — Manage → File Locations
Every config, service, backup and certificate path with a ✓/✗, so you can see what's installed and where it lives.

Changed

• Reachability is measured over TCP, never ICMP — networks that drop ping no longer look "offline" when the tunnel port works fine.
• Backups are pruned to the newest 10 archives and restore points to the newest 5, so neither can fill the disk.

Assets

File	Arch
backpack_linux_amd64.tar.gz	x86_64
backpack_linux_arm64.tar.gz	aarch64

Full changelog: https://github.com/AminMGMT/BackPack/blob/main/CHANGELOG.md

Backpack v1.3.0

Backpack v1.3.0

Install / update: bash <(curl -fsSL https://raw.githubusercontent.com/AminMGMT/BackPack/main/install.sh) — or just press Update in the CLI menu. Upgrading from a clone-based install (≤ v1.2.0): run Update once from your current menu; every update after that comes from these release assets automatically.

Added

• Edit tunnel ports from the CLI — per-tunnel Edit action: change the tunnel (control) port, the forwarded ports (server) or the server address (client). The tunnel restarts automatically and the hidden Telegram relay mapping is preserved.
• Change the web-panel port from the CLI and from the panel itself (with auto-redirect).
• Release-based install & updates — install.sh installs the prebuilt backpack_linux_<arch>.tar.gz into /root/BackPack; the in-app Update detects newer releases and swaps the binary, trying direct → tunnel SOCKS relay → public mirrors, so it works from Iran without Go or git.
• Offline install — download install.sh + the tar.gz on any machine, copy both to the VPS, run sudo bash install.sh.
• Backups folder — backups live in /root/BackPack/backups; Restore lists the archives there.
• Validation — bad port entries / tunnel names are rejected before they can crash-loop a tunnel service.

Changed

• CLI restyled & reorganized — red/white/gray theme, a gray description beside every option; new layout: Setup Server · Setup Client · Manage (tunnels, status, restart all, auto refresh) · Backup & Restore · Web Panel · Optimize · Telegram Bot · Update · Uninstall. Panel link & login code moved into the Web Panel section.
• Web panel is monitoring-only (best on the Iran server): live metrics, tunnel state/ping/logs. Management moved to the CLI; Settings keeps theme, update, panel port, password.
• Telegram bot relays through a tunnel by default — works 100% from Iran (a "direct" option remains for kharej).
• Watchdog client health-check now matches the peer IP, not just the port.

Fixed

• Session store purge (memory leak), panel restart after restore (restored port/password now apply), crash-loop on invalid port specs.

Assets

File	Arch
backpack_linux_amd64.tar.gz	x86_64
backpack_linux_arm64.tar.gz	aarch64