v0.48.3

Fixed

• Full access presented an AmneziaWG 3.0 server as "AmneziaWG Legacy". The
  container amnezia-awg3 matched the amnezia-awg prefix check and went into
  the link as the legacy container, so the AmneziaVPN app listed a Legacy
  protocol on a node that has none — and of course could not manage it. The app
  (5.0.0.5) only knows amnezia-awg, amnezia-awg2 and amnezia-openvpn-cloak;
  an unknown name becomes DockerContainer::None, so 3.0 is now left out of the
  full-access link entirely instead of being disguised as something else. If a
  node runs only 3.0, the panel refuses with an explanation rather than
  shipping a container the app would fail to find. Regular client configs for 3.0
  are unaffected and keep working — that is the way to hand out 3.0 access today.

v0.48.2

Fixed

• Installing AmneziaWG 3.0 aimed at the 2.0 port and left no way out. The
  deploy dialog sent port 47180 for every AmneziaWG flavour, so on a node
  already running 2.0 the 3.0 install hit the port guard — correctly refusing,
  but with no field to pick a different port, which was a dead end. 3.0 now
  defaults to its own port 47300, and when a port really is taken the dialog
  shows a port input (pre-filled with the next one) and a retry button.

v0.48.1

Changed

• Protocol tabs are ordered newest first: 3.0, then 2.0, then Legacy. The
  first tab is the one that opens by default, and on a node that already runs 3.0
  there is no point landing on 2.0.

v0.48.0 — реальная версия протокола

Added

• The panel now shows the protocol version a node actually runs, read from the
  config inside the container instead of guessed from its name. Container names
  don't carry the version — Amnezia names the container amnezia-awg2 for old
  1.0 servers too, so the card said "AmneziaWG" for everything. The node check now
  inspects each container's config: HeaderProtectionKey means 3.0, an I1 line
  (even commented out) means 2.0, neither means 1.0/legacy. Badges read
  "AmneziaWG 1.0 / 2.0 / 3.0" accordingly. Verified against production nodes,
  where it immediately revealed a server named amnezia-awg2 that is in fact
  running 1.0 (single-value H1–H4, no I1). Servers show the neutral old
  label until their next check populates the new data.

v0.47.5

Fixed

• Imported servers no longer carry a frozen "protocols: …" note. The importer
  wrote the protocol list from the vpn:// link into the server's note, where it
  stayed forever: the server later changed (a protocol removed, AmneziaWG 3.0
  added) while the card kept showing the original list right under the live
  protocol badges — and contradicting them. Live protocols come from the node
  check and are shown as badges; the stale duplicate is gone. Existing notes are
  left untouched (they are user-editable text) — clear one by editing the server.

v0.47.4

Fixed

• AmneziaWG 2.0 servers offered a bogus "update" to a 3.0 image. On
  2026-07-31 the upstream :latest tag moved to 3.0.x, and the 2.0 version check
  compared against :latest — so every 2.0 node showed "3.0.3 available", and
  pressing Update would have rebuilt a working 2.0 container on a different
  protocol's image. Version comparison and the update itself now stay on the 2.x
  line (newest by date, since tag 2.0.0 is older than 0.2.19), and an update
  never resolves to :latest. AmneziaWG 3.0 remains a separate protocol with its
  own container, deployed from its own tab.
• The 3.0 tab showed the 2.0 server's data. Switching protocol tabs kept the
  previous protocol's state on screen, so when 3.0 wasn't deployed the tab
  displayed 2.0's endpoint, subnet and client list next to the error "3.0 is not
  deployed" — it looked as if 3.0 were installed and owned those clients. State
  is now cleared before each load.

v0.47.3

Fixed

• The port-collision guard missed UDP ports — that is, every AmneziaWG port.
  docker ps --filter publish=NNN does not match a UDP publication without an
  explicit protocol, so a port held by a running 2.0 server looked free and the
  guard waved the deploy through. Caught on a live node. The check now asks for
  both NNN/udp and NNN/tcp, and refuses with a clear 409 either way.

Added

• Documented, verified rollback for 3.0 in both READMEs: what the pre-deploy
  backup covers, why installing 3.0 cannot disturb a running 2.0, and the exact
  commands to remove 3.0 entirely. Verified on a production node — after install
  and rollback the 2.0 container was byte-identical (same container ID, config
  hash, clients and handshakes).

v0.47.2

Fixed

• v0.47.1 was broken and must not be used: app/config.py shipped empty, so
  the backend failed to import and the container wouldn't start. A bad in-place
  edit truncated the file before reading it. Restored, with the release pipeline
  otherwise unchanged. Anyone on 0.47.1 should move to 0.47.2.

Added

• A full pre-deploy backup is now taken before installing AmneziaWG 3.0 on a
  node that already runs 2.0. Previously the pre-op snapshot covered only the
  3.0 container — which does not exist on a first install, so the operation ran
  with no backup of the working 2.0 next to it. Snapshots stay namespaced per
  protocol (restore unpacks into its own container, so mixing them would corrupt
  the wrong one), and the 3.0 deploy now snapshots both.
• Port-collision guard. The deploy script removes whatever container holds
  the target port (that is how it replaces its own on a rebuild), so pointing a
  3.0 deploy at a port already used by another protocol would have destroyed a
  working container together with its clients. The panel now refuses with a clear
  409 instead.

v0.47.0 — AmneziaWG 3.0

Added

• AmneziaWG 3.0 support — deploy and manage it as its own protocol, next to
  2.0 and legacy, exactly as those two coexist. A 3.0 server gets its own
  container (amnezia-awg3), port, subnet (10.8.3.0/24) and config directory,
  so both versions run on one node without touching each other's clients. All the
  usual client operations are there: issue (.conf plus a vpn:// link with
  protocol_version = 3), fetch a stored config, reissue, pause/resume, revoke,
  expiry auto-revoke, snapshots and rollback.
• 3.0 protocol parameters, taken from upstream sources rather than guessed
  (amneziawg-tools v3.0.20260730, amneziawg-go v3.0.2): HeaderProtectionKey
  (a 32-byte shared secret that encrypts packet headers), ContentPaddingAddition,
  and the randomizable timing ranges RekeyAfterTime, RekeyTimeout,
  RejectAfterTime, KeepaliveTimeout, MaxHandshakeAttempts. Clients mirror
  them from the server, as they already do for H1–H4.
• 3.0 is built from source on the node at pinned tags. The published
  amneziavpn/amneziawg-go image — even tagged 3.0.2 — still ships
  amneziawg-tools v1.0.20210914 and an engine without the 3.0 UAPI keys, so
  awg setconf rejects HeaderProtectionKey outright (verified on a live node).
  Building the engine and tools ourselves is the only way to get a working 3.0
  today, and it removes the dependency on when upstream refreshes that image.

Fixed

• A 3.0 container is no longer mistaken for a 2.0 one. Both use awg0.conf,
  so the 2.0 detector happily picked up amnezia-awg3 — on a node running both,
  2.0 operations would have landed on the 3.0 server (a client issued in the
  wrong place). Detection now excludes 3.0, which has its own /awg3 path.
  Conversely, the panel's own 3.0 image counts as ours, so its presence no longer
  blocks deploying or updating 2.0 on the same node with a 409.

v0.46.1

Fixed

• The API docs page at /api/docs opened blank. FastAPI's stock Swagger page
  pulls its JS/CSS from an external CDN and boots them with an inline script;
  the panel's strict Content-Security-Policy (script-src 'self', no
  'unsafe-inline') blocked both, so only an empty page loaded. Rather than
  weakening the policy, the panel now serves Swagger UI from its own origin: the
  assets are copied from the swagger-ui-dist package at build time and the
  initialization lives in a separate file instead of inline. The CSP is unchanged,
  and the docs now also work on networks where the CDN is unreachable — which
  matters for a tool that often runs in exactly those networks.