Hotfix: Reality/XHTTP outage after update + bootstrap
A silent, total outage of Reality and XHTTP could occur after moav update followed by moav bootstrap — sing-box logs REALITY: processed invalid connection, clients see received real certificate — even though keys, bundles, services, and the TLS cert are all intact and unchanged.
Root cause: the sing-box/xray config templates interpolate ${REALITY_SHORT_ID}, which docker-compose passes in from .env. But the short_id's source of truth is the state (state/keys/reality.env), not .env. .env.example ships REALITY_SHORT_ID= empty and an update can reset it, so at render time the empty .env value shadowed the real state value → "short_id": [""] → the server rejects every real client. (The private key was never affected — it isn't passed through .env.)
Fix: bootstrap now re-sources state/keys/reality.env immediately before each config render, so the authoritative state value always wins.
If you're already hit (recover without updating)
# real short_id is in state/keys/reality.env
sed -i 's|^REALITY_SHORT_ID=.*|REALITY_SHORT_ID=<the-real-sid>|' .env
rm -f configs/sing-box/config.json configs/xray/config.json
moav bootstrap --yes && moav restart sing-box xrayExisting user bundles keep working — nothing to re-issue.
Upgrading
After updating, also run moav cert install if moav doctor reports "Cert auto-renewal is NOT scheduled" — the auto-renewal shipped in 1.8.5 but is installed once (systemd timer / cron.d). Without it the Let's Encrypt cert silently expires at ~90 days and the TLS protocols go down.
Full changelog: see CHANGELOG.md → [1.8.6].
Quick Install
curl -fsSL moav.sh/install.sh | bashThis will install MoaV to /opt/moav and guide you through setup.
Documentation
moav.sh/docs — Full documentation
- Setup Guide — Complete installation instructions
- Client Setup — How to connect from devices
- DNS Configuration — DNS records setup
- CLI Reference — All commands and options
- Monitoring — Grafana dashboards and metrics
- Troubleshooting — Common issues and solutions