Skip to content

v2.1.0

Latest
Latest

Choose a tag to compare

View all tags
@shayanb shayanb released this 12 Aug 01:17
v2.1.0
e100baa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bug fixes across user-bundle generation, one security fix, and two changed defaults.
Keys, users and certificates are untouched.

Special thanks to @iaghapour for the Farsi how-to video — watching a real operator work through a real install surfaced several of the bugs fixed below.
Watch it here: https://www.youtube.com/watch?v=UndaXuS9-Ws"

Upgrade

moav update
moav build admin        # required — see below
moav regenerate-users   # required to see the bundle fixes
moav start

moav update prints these steps for you. Two of them matter more than usual:

  • moav build admin is not optional. The admin container no longer receives ADMIN_PASSWORD from Compose — its entrypoint reads .env directly — and that entrypoint is baked into the image. An un-rebuilt image sees no password and the dashboard locks itself with a 503.
  • moav regenerate-users is what your users actually notice. Existing bundles were built by the old code. They gain the Slipstream and MasterDNS configs, the TrustTunnel and DNS-tunnel sections in their guide, and the dnstt key only after a regenerate.

Two changed defaults

  • CDN links are now opt-in (ENABLE_CDN=false). A CDN link only works once the subdomain is actually proxied through Cloudflare and its port rewritten, and shipping CDN_SUBDOMAIN=cdn with no switch meant every new server handed users a config that could not connect. Existing servers are unaffected — with the variable absent from your .env, the old rule still applies, so a working CDN is never silently lost. moav doctor dns now verifies the record is genuinely proxied, not merely resolving, and names both fixes when it is not.
  • Donated users get fewer protocols, deliberately. Donate mode now restricts to the requested set. Previously it leaked your full protocol list to the recipient network.

Fixed

  • Slipstream and MasterDNS were missing from every user bundle. Both services ran; nobody could use them. The host add path looked for their keys in a directory that only exists inside the containers, and skipped both in silence while still reporting success — two last-resort transports served to nobody.
  • TrustTunnel and the DNS tunnels were invisible in the bundle guide. Their sections keyed on filenames nothing has ever written, so they were hidden in every bundle ever produced. All 14 protocols were audited; nothing else was affected.
  • moav migrate-ip left TrustTunnel users on the old server. It rewrote a file that does not exist while the two that carry the server IP were untouched.
  • Disabled protocols still reached bundles. With ENABLE_TROJAN=false, moav user add still produced Trojan links and QR codes. The host and container add paths had drifted apart, so bootstrap-created users looked correct and every user added afterwards did not.
  • Donate mode restricted nothing. Its overrides never reached the scripts that generate almost everything, so a donation requested as "reality hysteria2" shipped six more protocols to the recipient.
  • dnstt was listed for users who never got it, including donated users, in both the dashboard and the guide. It now ships its server key per user like every other protocol.
  • moav.sh/llms.txt links were broken. The links to AGENTS.md and the developer docs were relative, so an AI agent given the URL followed them to moav.sh/AGENTS.md and got nothing. llms-full.txt had the same fault in 46 places.
  • moav user base64 was mistaken for a subscription and rejected by phone apps — correctly, since it is a zipped bundle for the MoaV client. The docs said otherwise; they no longer do.

Security

  • Admin container secrets are out of the container config. docker inspect moav-admin printed 130 environment variables, including ADMIN_PASSWORD, REALITY_PRIVATE_KEY and MAHSANET_API_KEY, because Compose injected the whole .env. The entrypoint now reads it as root and passes only what the app needs: 130 variables down to 20, with none of the three secrets.

Added

  • moav user sub NAME — the base64 subscription that phone apps import (Streisand, v2rayNG, NekoBox, Hiddify).
  • Run MoaV with an AI agent — a new docs page: which file to point an agent at, a prompt to start from, and the guardrails worth keeping. (Thanks to eferbarn for reporting this issue)
  • XHTTP is donated by default, and the release footer you are reading is now generated, so its links can no longer drift.

Removed

  • The WireGuard-over-wstunnel QR code. It pointed at 127.0.0.1, so scanning it produced a tunnel that connected and carried no traffic — indistinguishable from the real QR. The config still ships, with the caveat stated. The plain WireGuard QR was investigated and is correct.

Full Changelog: v2.0.1...v2.1.0

Quick Install

curl -fsSL https://moav.sh/install.sh | bash

This will install MoaV to /opt/moav and guide you through setup.

Documentation

moav.sh/docs — full documentation

Get started

Reference

Understand it

Help out

Running it with an AI agent? llms.txt is a compact
orientation for coding agents; llms-full.txt is the
whole corpus. Both ship as release assets.

Community

Telegram · X · Issues · moav.sh

Assets 4
Loading