MotherofallVPNs/MoaV v2.0.0-rc.3

v2.0.0-rc.3 — EXPERIMENTAL, not for production use

on GitHub

⚠️ Experimental release candidate — not for production. For testing and feedback only. The moav.sh/install.sh one-liner still installs stable v1.9.1; this RC must be installed explicitly (below).

v2.0.0 is the same protocols you already run, rebuilt underneath: a security and correctness pass, a much smaller dispatcher, and a lot of quietly-broken things fixed. No new protocols. Your keys, users, and certificates are preserved on upgrade.

Install / test this candidate

Fresh install of this exact RC:

curl -fsSL https://raw.githubusercontent.com/MotherofallVPNs/MoaV/v2.0.0-rc.3/install.sh | bash -s -- -b v2.0.0-rc.3

Always-latest dev build (moves ahead of this tag as fixes land):

curl -fsSL https://raw.githubusercontent.com/MotherofallVPNs/MoaV/dev/install.sh | bash -s -- -b dev

In-place upgrade from an existing install (see V2-MIGRATION):

moav update -b v2.0.0-rc.3 && moav build && moav start

Since rc.2

🔒 Security

• sing-box no longer downgrades state-key ownership on every start — its blanket chown -R of the state volume was the real source of 999-owned keys; the cache moved to the log volume and /state is now mounted read-only for it.
• The state-key/bundle permission repair can no longer be bypassed — moav start <service> and moav restart skipped it; all start/restart paths now funnel through one guarded entry.
• Pre-v2 adversarial security pass landed: Reality short_id render-guard anchors to the JSON field (no false PASS from a lookalike substring), the CDN WebSocket path uses 48-bit openssl entropy instead of $RANDOM, and its value is no longer echoed to logs. No critical/high findings.
• User bundles are no longer world-writable/readable (deterministic uid-2000 ownership replaces chmod 777), clash-api.env is 0600 via a root-entrypoint env handoff, and the key-perms repair now actually reaches existing installs.

🐛 Fixed

• moav user add no longer corrupts a user's UUID or fails on WireGuard/AmneziaWG — a two-line UUID from a timed-out generator was breaking credentials.env, bootstrap, regenerate-users, and crash-looping xray; the wg/awg keygen fallback now uses the locally-built images (the old lscr.io fallback isn't pulled and has no awg).
• Grafana no longer crash-loops over cosmetic branding on hosts where its image dir isn't writable — this restart-storm was also starving the docker daemon and triggering the intermittent user-add failures.
• XHTTP_REALITY_TARGET actually defaults to REALITY_TARGET now (was silently hardcoded), with a CI test covering every nested env-fallback chain.
• Four regressions from the first live 1.9.1→v2 upgrade (key ownership, non-root daemon keys, exporter crash, xray log tailer) plus the follow-ups (moav test wstunnel/snowflake warnings, disk output, doctor).
• moav doctor: no longer fails a healthy sub-2 GB host (RAM/monitoring is advisory now), and buffer sizes no longer print as "0 MiB".
• moav user add can no longer hang on a wedged container — every container call has a hard deadline (#220).
• Three strict-mode crashes in cert-wait/fallback entrypoint paths; full set -eu now on every entrypoint including grafana/grafana-proxy.
• The Grafana browser-tab favicon is now the MoaV icon (was only the login logo); cAdvisor logs are quiet; the installer's network-tuning prompt explains itself and prints cleanly.

✨ Changed

• .env.example is one reorganized file: ~29 essentials with descriptions on top, a hard ADVANCED — only change things below if you know what you're doing separator, everything else below. Nothing removed.
• User bundles show only the protocols the user actually has (#73) — no more "No X config available" filler; moav regenerate-users refreshes existing bundles.
• Monitoring defaults ON above ~1 GB RAM (a "2 GB" VPS reports ~1990 MB and was wrongly defaulting off).
• AnyTLS coverage re-enabled — it works; #204 was a misdiagnosis.
• Community links (Telegram, X, GitHub issues) in moav start/status, the goodbye message, and the installer's completion banner — plus a bandwidth-donation CTA (moav donate) after start.
• The admin dashboard title shows your domain: MoaV - <domain> - Dashboard.

🤖 Docs & agents

• Root llms.txt + AGENTS.md (server-operator agent guide: everyday ops, dashboards & access, safety notes) and a v2 migration guide (docs/V2-MIGRATION.md).
• README: centered header with logo, dynamic release badges, language links, and the companion moav-client.

🧹 Internal

• Retired the obsolete wg-sync-keys.sh workaround; wg/telemt user-add routed through the shared libs; five .env scrapers migrated to the single accessor (and the quote-blind test hole closed); regression tests added for every fix above — the CI suite now has 20+ dedicated bash suites.

📋 Full detail: CHANGELOG · 🔀 Compare: v2.0.0-rc.2...v2.0.0-rc.3

🐛 Found a bug? Open an issue · 💬 Telegram