Shunt 2.1.0

Security: 2.0.0 is affected

A gateway installed from the 2.0.0 package signs its session cookies with a
fallback value that is published in the source, because nothing in that package
ever created the per-install secret the application expects. Anyone who can
reach the web interface can mint a valid administrator session without knowing
the password — on a home gateway, that means anyone on the network it serves.

Only the pre-package install.sh ever wrote that file, and migrating from an
xray-gateway installation did not carry it across. Assume any 2.0.0 install
is affected unless the file is present:

ls -l /opt/shunt/.secret

Upgrading to 2.1.0 generates one and keeps an existing one, so current sessions
survive the upgrade. While you are there: the interface still ships with
admin / admin, and this release does not change that. Change it.

Also fixed

• shunt-first-boot.service was enabled by the installer but its ExecStart
  pointed at a source tree the package never creates, so it failed at every
  boot of a fresh install. Removed, along with any copy 2.0.0 left enabled.
• update-geo.sh fetched 92 MB with --connect-timeout, which bounds only the
  handshake. A connection that opened and then stalled hung forever — during
  installation and in the weekly timer alike. It now gives up on a transfer
  that stays under 1 kB/s for a minute.
• iptables.sh could die part-way through up with the TPROXY jump already
  attached to PREROUTING and nothing listening on the tproxy port. A gateway
  in that state is not degraded; it silently drops every packet forwarded
  through it. Setup is now all or nothing.
• That failure was reachable on every fresh install: the setup required the
  agvpn account, which only exists once adguardvpn-cli is installed, so
  routing could never start on a new machine at all. Its exemption is now
  skipped with a note when the account is absent.
• Units that cannot succeed on an unconfigured machine no longer report faults
  or retry forever — the rescue Wi-Fi AP and the FPTN backup egress are skipped
  by a condition, and the core gives up after five attempts instead of
  restarting every five seconds.

New

• /etc/sysctl.d/90-shunt.conf ships with the package as a conffile. IP
  forwarding, route_localnet, BBR with fair queueing, and IPv6 disabled — the
  last is load-bearing rather than tidy, because a live IPv6 path leaves
  through the WAN port unsplit and untunnelled.
• packaging/mkiso.sh turns the official Debian 13 amd64 netinst image into
  one that installs Debian and both packages unattended, on a machine with no
  keyboard or monitor. It needs only xorriso.

Install

shasum -a 256 -c SHA256SUMS
sudo apt install ./shunt_2.1.0_all.deb ./shunt-xray_26.3.27_amd64.deb

sing-box is not in the Debian archive and is installed separately from
upstream; without it everything works except the SOCKS proxy features.

Why there is no installer image attached

An image everybody downloads would have to carry credentials everybody knows.
mkiso.sh refuses to build without an SSH key or a password of your own, so
build it yourself:

./packaging/mkiso.sh --iso debian-13.6.0-amd64-netinst.iso \
                     --ssh-key ~/.ssh/id_ed25519.pub

Shunt 2.0.0

Renamed from xray-gateway to Shunt, and packaged for Debian and Ubuntu.

A shunt, in the electrical and railway senses, diverts part of a flow onto
another path. The old name promoted one replaceable component — xray-core sits
beside sing-box, dnsmasq and several egress providers — into the name of the
whole product.

Install

shasum -a 256 -c SHA256SUMS
sudo apt install ./shunt_2.0.0_all.deb ./shunt-xray_26.3.27_amd64.deb

The Python dependencies come from the distribution archive. sing-box is not
in it and is installed separately from upstream; the gateway runs without it,
but the SOCKS proxy features stay unavailable.

On a fresh machine the management interface starts on port 80 and the routing
services are enabled but deliberately not started — they rewrite firewall
and routing tables, which should not happen unattended during a package
install. Review the detected layout, then systemctl start shunt sing-box.

Upgrading from xray-gateway

The install path moves from /opt/xray-proxy to /opt/shunt and the units
from xray-* to shunt-*, so this is a breaking change. Installing over an
existing tree migrates the configuration, database and logs, retires the old
units and brings back up exactly the services that were running. The old code
is left in place for you to delete.

Check a machine before attempting it:

sudo bash tools/preflight.sh

It changes nothing, and it catches the failure that matters: if the interface
names in network.conf are wrong, the firewall script aborts and takes the
NAT with it, which leaves the whole network offline.

Also in this release

• The interface is available in Russian and English, switchable at runtime.
• geoip.dat and geosite.dat are no longer shipped in the package — they go
  stale, so they are downloaded after installation and refreshed weekly by a
  timer.
• shunt-xray carries the xray-core binary separately, so the core can be
  updated on its own.