Back up /root/cert alongside letsencrypt, and on restore recreate the
webCertFile symlinks from the DB for older backups that lack them —
without them x-ui serves plain HTTP and every nginx proxy_pass https://
(panel + diag bridge) breaks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On Ubuntu 24.10+ /tmp is a size-limited tmpfs, so mktemp -d staging could
not hold the uncompressed copy of the panel, web roots and certs. Stage
backup/restore work dirs inside /var/backups/x-ui instead, and verify
free space (2x estimated size + 100 MB margin) before touching anything.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Single 512 MB POST over HTTP/2 was throttled by the per-stream h2
flow-control window, reading ~4x low. LibreSpeed uses parallel upload
streams measured via XHR progress events, which amortizes the window
limit (h2 must stay on for trojan-gRPC).
- Vendor speedtest.js + speedtest_worker.js (LGPL) into assets
- mtr-backend.py: ThreadingHTTPServer, /api/st/up upload sink,
/api/st/getip; parallel streams need concurrent handling
- nginx: speedtest locations without limit_req (limit_conn instead),
ping answered by nginx directly, h2 preread/body buffer tuning
- No telemetry, no database
- Drop 512 MB test file; patch script now also substitutes
__SERVER_DOMAIN__/__SERVER_IP__ placeholders
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Custom header X-Proxy-Provider is not sent by ClashMi and other clients
that don't support header: in proxy-providers. URL query param works in
all clients universally.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
include-all is Mihomo-only; explicit use: [sub] works in all Clash clients.
Also remove empty proxies blocks and non-standard remnawave field.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When Mihomo fetches proxy-providers it sends a Clash UA, causing nginx to
return clash.yaml instead of the actual proxy list — resulting in empty groups.
Fix: proxy-providers in clash.yaml now send X-Proxy-Provider: true header.
nginx map checks combined key "$is_clash_ua:$http_x_proxy_provider":
- Clash UA with no header ("1:") → serve clash.yaml (initial import)
- Clash UA with header present → pass through to x-ui sub port (provider refresh)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
expected-status: 204 ended up after the rules section instead of
inside proxy-providers.sub.health-check where it belongs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- clash.yaml template (proxy-providers -> x-ui base64 sub URL) in assets/clash/
- install_clash_sub() downloads and substitutes domain/sub_path at install time
- nginx: map $http_user_agent $is_clash_client detects Clash/Mihomo/Stash/Surfboard
- sub_path locations rewrite to internal /__clash_sub on UA match
- /__clash_sub serves /var/www/subpage/clash.yaml as text/yaml
- Regular clients still proxy to x-ui sub port unchanged
- Uninstall cleans /var/www/subpage/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Download uses fetch() with streaming progress on 100MB test file.
Upload sends 25MB to /api/upload on mtr-backend which reads the full
body before responding, giving accurate client-side timing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
