MoaV 2.2.1

A patch on top of 2.2.0: three bug fixes, eight dependency version bumps, and a slimmer README. No new features, no config changes, nothing breaking. Keys, users and certificates are untouched.

Upgrade

cd /opt/moav
moav update
moav build sing-box xray telemt wstunnel   # rebuilt from source at the new versions
moav start                                  # pick up the rebuilt images

Monitoring images (Prometheus, Grafana, node_exporter, cAdvisor) pull latest, so moav update refreshes them with nothing to build.

Fixed

• WireGuard / AmneziaWG could hand two users the same IP. A stored client address was reused without checking it was still free, so a duplicate (from the old peer-count+1 allocator, a state restore, or a regenerate ordering) put two peers on one IP and broke routing for both. The address is now checked against the config and reassigned when it collides. If you have hit WireGuard peers that connect but pass no traffic, this is very likely why.
• moav doctor dns now recognises AWS CloudFront. It previously only knew Cloudflare's cf-ray header, so a correctly set-up CloudFront distribution was reported as broken. It now names whichever CDN is in front and gives CloudFront-specific guidance.
• Removed a monitoring target that could never come up. telemt exposes its raw metrics only on localhost, so that Prometheus scrape sat permanently red. telemt's data still reaches Grafana through its API exporter.

Dependencies

All bumped and verified running on a live server. The proxy engines were rebuilt from source with MoaV's configs unchanged (no schema break) and are serving live traffic; the monitoring pins were simply behind what latest already runs.

Proxy & transport

Monitoring

AmneziaWG 3.0 is deliberately not in this release. It is a protocol jump (tools and the Go userspace bumped in lockstep) whose value is new obfuscation our config generation does not yet emit, so a bare binary bump would add nothing while risking live clients. It is tracked as a feature.

Docs

• AWS CloudFront CDN setup is now documented end to end, including the origin setting the AWS console hides (the origin must be HTTP on port 2082), the verify steps, and the origin-exposure note. See DNS → CDN mode.
• A shorter README. The protocol and port information is now one table (with a Domain? column) instead of three overlapping lists, plus a "See it in action" screenshots section and less repetition.

Internal

• e2e preserves the Let's Encrypt certificate across runs (full/mega runs were spending an issuance each and hitting the 5-per-168h limit); a fresh_cert dispatch input forces a real issuance when needed.
• CI link checks no longer fail a release when GitHub rate-limits an unauthenticated request; the docs links that actually rot stay strict.
• The charts workflow fetches tags and skips a single unbuildable chart instead of failing the whole run.

Thanks

Found and verified on live servers. The WireGuard fix in particular came from a real duplicate-IP report.

Full changelog:

• https://github.com/MotherofallVPNs/MoaV/blob/main/CHANGELOG.md
• v2.2.0...v2.2.1

Quick Install

curl -fsSL https://moav.sh/install.sh | bash

This will install MoaV to /opt/moav and guide you through setup.

Documentation

moav.sh/docs — full documentation

Get started

• Quick Start — install to first user in ~10 minutes
• Client Setup — connect from phones and desktops
• DNS Configuration — records, delegations, freeing port 53

Reference

• CLI Reference — every command and flag
• Setup Guide — every option, in depth
• Monitoring — Grafana dashboards and metrics
• Troubleshooting — symptom-first fixes

Understand it

• Supported Protocols — per-protocol ports, ciphers, stealth
• Architecture — container topology and bundle flow
• Threat Model — what is and is not protected
• OPSEC Guide — operator-side hardening

Help out

• Support MoaV — run a server, contribute, translate, donate
• Translating the Docs — one page is a complete contribution

Running it with an AI agent? llms.txt is a compact
orientation for coding agents; llms-full.txt is the
whole corpus. Both ship as release assets.

Community

Telegram · X · Issues · moav.sh