Skip to content

SharX v2.0.0-beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jun 14:51
v2.0.0-beta
c40f9c4

🐳 Container images — GitHub Packages (GHCR)

Image Pull
panel docker pull ghcr.io/teslaproduuction/sharx:2.0.0-beta · ghcr.io/teslaproduuction/sharx:latest-beta
node docker pull ghcr.io/teslaproduuction/sharxnode:2.0.0-beta · ghcr.io/teslaproduuction/sharxnode:latest-beta

🚀 Quick start

curl -LO https://github.com/teslaproduuction/sharx-UI/releases/download/v2.0.0-beta/docker-compose.yml
docker compose up -d   # panel → http://<host>:2053

SharX v2.0.0 — Phase 1–4 sing-box backend, multi-node cascade, WARP

Highlights

  • Caddy panel masking + Hiddify-style decoy (Phase 1) — panel hides behind
    random /<prefix>/ path; unrecognized URLs reverse-proxy to a real third-
    party site (decoy). Mascaraed mode shifts the root / to the decoy after
    a delay so active probes see only the decoy.

  • 5 new inbound protocols via hiddify-sing-box (Phase 2):

    • mieru (anti-DPI, no TLS, port-range support)
    • AnyTLS (TLS + padding-scheme)
    • Naïve (Chromium-Naïve, h2/h3)
    • TUIC v5 (QUIC + congestion control)
    • Telemt (MTProto for Telegram) — was already there, kept

    Single sing-box singleton sidecar manages all four. Per-user stats via
    hiddify-fork v2ray_api gRPC (user>>><email>>>traffic>>>uplink|downlink)
    merge into the existing Xray puller — full per-user billing works.

  • Cascade chains (Phase 3+4): chain a sing-box mieru/anytls/tuic/hy2
    CLIENT outbound on one node to a mieru/anytls/… server on another node.
    Each OutboundSidecar auto-creates a matching Xray socks outbound
    (<name>-local) so RoutingBuilder can address the cascade member by
    friendly name. OutboundChain rows compile into Xray routing.balancers

    • observatory.subjectSelector so multi-member chains support leastPing.

  • Cloudflare WARP egress (Phase 3-B): anonymous register against
    api.cloudflareclient.com/v0a4005/reg, auto-create matching Xray native
    wireguard outbound (warp-<name>). RoutingBuilder can target
    outboundTag: warp-<name> to send selected traffic via CF anycast.

  • Multi-node mode with full sing-box config push: panel sends
    {config: <xray>, telemt: [...], singbox: {cfg, configHash}} envelope;
    workers spawn per-node sing-box singletons. Panel host doubles as
    "cascade hub" — runs sing-box for inbounds/sidecars left unassigned to
    any worker (NodeIds empty).

  • 3 new UI tabs: Sidecars / WARP / Chains. Dashboard widget shows local
    sing-box state + cfgHash per node.

Phase 9–11 additions (final v2.0.0)

AmneziaWG + mieru server in one sing-box

  • Switched the singleton sidecar to shtorm-7/sing-box-extended (built from
    source, lean tag set). The hiddify fork DROPPED the amnezia endpoint option;
    shtorm-7 keeps it and the per-user v2ray_api stats + anytls/tuic/hy2 +
    mieru-outbound. Verified sing-box check accepts the amnezia block (jc/jmin/
    jmax/s1-s4/h1-h4/i1-i5/j1-j3/itime) — real AWG 1.5 anti-DPI obfuscation for WARP.
  • mieru server inbound (native): upstream shtorm-7/sing-box-extended now
    registers mieru as both an outbound and an inbound (include/registry.go
    calls mieru.RegisterInbound + RegisterOutbound), so the build needs no
    source graft. The image pins a known-good extended commit for reproducible
    builds. Result: one binary runs a mieru server inbound + an AmneziaWG WARP
    outbound simultaneously    .
  • WireGuard moved to endpoints[] (sing-box 1.11+) with CIDR address
    normalization (WARP/.conf bare IPs → /32,/128).

:443 SNI router (Phase 11)

  • Caddy layer4 plugin fronts :443 and SNI-routes TCP inbounds flagged
    Share TLS :443 to their real backend port (TLS passthrough); the HTTP panel/
    decoy moves to :8443. Lets VLESS/Trojan/AnyTLS share :443; Hy2/TUIC use
    :443/udp. Panel builds the layer4 server JSON and pushes it to the Caddy admin
    API (SNI_ROUTING_443=true). Duplicate-SNI conflicts detected + skipped.
  • Share links advertise :443 for these inbounds (sni= carried), so clients
    connect to :443 and Caddy routes by SNI.

Cores management + observability (Phase 10)

  • Cores page: unified per-core cards (Xray / Sing-box / Telemt) with live
    status, Stop / Restart / Logs, version + uptime, and a Telemt version
    switcher     (lists telemt/telemt releases, hot-swaps the binary). Dashboard core
    card split into 3.
  • Sidecar log capture: ring buffer per sidecar; lines also flow into the
    unified Журнал log viewer (new telemt / singbox source filters) + live SSE.
  • Outbound live 204 test: fetches generate_204 THROUGH the outbound (SOCKS/
    HTTP + local sidecar bridges) → latency + status, or the failure (falls back to
    TCP for protocols not proxiable from Go).
  • AmneziaWG .conf drag-drop import + tuic/hy2/anytls URI import on the
    Outbound Sidecars page.

Panel-as-node hybrid + L7 routing + cascade UX (Phase 9)

  • Hybrid panel host (panelHostWorkload): in multi-node mode the panel host
    can ALSO run its own workload (real nodes row id=0) while orchestrating workers.
  • Product-grade L7 routing constructor (3X-UI style): rule presets, outbound/
    balancer target combobox, load-balancer editor (routing stays visual for
    cascades), rule reordering, inline guides.
  • Cascade builder guide: flow diagram + per-field explanations.

Upstream merge

  • Merged konstpic v1.4.5 (VLESS encryption/decryption, Hy2 same-port +
    salamander fix, panel-assigned nodeId, Telemt fixes, IP-limit job, log-rotate).
    ClientEntity.Email → Name rename absorbed.

Migrations added this phase

0050_panel_host_node.sql (seed panel-host node id=0), 0051_inbound_sni_443.sql
(share_tls_443 + sni columns).

New env vars

Var Default Purpose
SNI_ROUTING_443 false enable the Caddy :443 SNI router
CADDY_HTTP_PORT 8443 internal port the HTTP panel/decoy moves to when SNI routing is on
SINGBOX_EXT_VERSION (pinned) shtorm-7 sing-box-extended release/ref for the build

Known-issue updates

  • Naïve client outbound unsupported / CF per-mode provisioning scaffold /
    React read-only CRUD — sidecar/chain/WARP CRUD shipped; sing-box source is now
    shtorm-7 (not hiddify). AmneziaWG obfuscation now works.
  • docker compose build on Docker Desktop may not retag :latest (buildx cache
    quirk) — build/deploy with docker build -t sharx-ui-sharx:latest … locally.

Live verification snapshots

End-to-end RU panel → IN worker mieru tunnel:

$ curl --socks5-hostname 127.0.0.1:43213 https://ipinfo.io/ip
203.0.113.7         # ← exit-node (India worker) IP, returned through cascade bridge

Breaking changes / migration

  • Fresh-install only. No legacy envelope compatibility shims (per
    master-plan Q10). v1.x → v2.0 upgrade path: drop the old DB, run all
    migrations from scratch.
  • DB migrations 0041 → 0049 add: worker_version, singbox_state,
    singbox_config_hash, panel_security settings, singbox_inbound_support,
    singbox_pending_changes, outbound_sidecars + node mappings,
    warp_accounts, outbound_chains + members, cloudflare_*.
  • The 0045_singbox_pending_changes.sql migration is a no-op kept for
    version-numbering continuity; the queue table is actually created by
    0044 (column name payload, NOT payload_json).

Environment

New env vars consumed by the panel/node:

Var Default Purpose
SINGBOX_BIN /app/bin/sing-box path to hiddify-sing-box binary
SINGBOX_WORK_ROOT /app/singbox per-instance config + work dir
PANEL_DOMAIN — Caddy ACME issuer email + cert subject
PANEL_SECRET_PREFIX — random /<prefix>/ path that hides the panel
PANEL_DECOY_URL https://example.com upstream the decoy reverse-proxies to
PANEL_BACKEND_HOST 127.0.0.1 backend host Caddy forwards panel traffic to
PANEL_BACKEND_PORT 2053 backend port Caddy forwards panel traffic to
SUB_BACKEND_PORT 2096 backend port Caddy forwards subscription to
NEXT_PUBLIC_BASE_PATH / Next.js bake-time prefix; must match the 
    Caddy secret prefix |

Existing env vars unchanged.

Known issues

  • Naïve client outbound is unsupported in this build (needs CGO +
    Chromium's cronet C library). AnyTLS / TUIC / Mieru / Hy2 clients are
    pure-Go and ship in the default build.
  • Observatory probe interval default = 300s. Tighter intervals against
    unreachable cascade members will spike CPU (DNS retry loop on every probe).
  • Sing-box hot-reload is stop+spawn (not SIGHUP) — hiddify-fork's
    protocol/naive Close path NPEs in fswatch when reloading TLS-bearing
    outbound configs. Stop+spawn sidesteps the bug at the cost of ~1s
    downtime per config push.
  • CF API per-mode provisioning (DNS + Workers) is scaffold only — the
    entity + service + HTTP CRUD ship in this release but the per-mode
    worker-script-deploy / DNS-record-create paths land in v2.1.
  • React full CRUD for OutboundSidecar / OutboundChain — read-only list
    view in this release. Full forms ship in v2.1.
Assets 4
Loading