Monitoring gets two new dashboards, AmneziaWG moves to v3 obfuscation, and user bundles gain a compact moav:// subscription. Keys, users, and certificates are otherwise untouched.
⚠️ Breaking for existing AmneziaWG users
AmneziaWG moves to v3 obfuscation (header protection, content padding, v3.1 RandomTrailers). The v3 params are mandatory-match with no fallback: a v3 server silently drops handshakes from clients that don't carry the identical params, and older client apps can't parse a v3 config. To upgrade:
moav update
moav regenerate-users
regenerate-users backfills awg0.conf with the v3 params (your H/S values and WireGuard keys are left untouched) and re-issues every bundle. Then have AmneziaWG users re-import their bundle in a v3-capable client app. AWG_DISABLE_COOKIES=true is available as an opt-in for extra obfuscation (default off).
What's new
- Two new Grafana dashboards. A cross-protocol Overview and an experimental Research site-analytics view (behind
ENABLE_SITE_ANALYTICS_RESEARCH). The monitoring refresh adds an active/traffic/provisioned protocol table, VPN-vs-bridge separation, per-protocol and bridge traffic, a growth chart, Snowflake reach, and one consistent colour per country and protocol. moav://compact subscription. Each user bundle'ssubscription.txtnow carries a singlemoav://line encoding the whole enabled proxy surface, alongside the usual per-protocol URIs. MoaV Client expands and de-duplicates it; other clients ignore it. See the moav:// bundle.
Fixes & hardening
moav regenerate-usersnow reloads WireGuard and AmneziaWG — regenerated peers were written to disk but never loaded into the running server, so the tunnel handshook but passed no traffic. It now hot-syncs WG peers and reloads AWG.- A malformed
credentials.envis rejected with a clear fix hint instead of silently producing a bundle with empty credentials. - The MahsaNet donate endpoint now validates the
protocolsrequest body. - Conduit CPU-budget warning when the client count exceeds the sidecar's 0.5-CPU allocation.
- A note on a fresh (domainless) install explains the expected browser
ERR_CERT_AUTHORITY_INVALIDwarning and how to get a trusted certificate.
Validated by a full end-to-end run (domain + domainless).
Full changelog: CHANGELOG.md.
Full Diff: v2.2.1...v2.2.2
More detail on what is included : #313
Quick Install
curl -fsSL https://moav.sh/install.sh | bashThis will install MoaV to /opt/moav and guide you through setup.
Documentation
moav.sh/docs — full documentation
Get started
- Quick Start — install to first user in ~10 minutes
- Client Setup — connect from phones and desktops
- DNS Configuration — records, delegations, freeing port 53
Reference
- CLI Reference — every command and flag
- Setup Guide — every option, in depth
- Monitoring — Grafana dashboards and metrics
- Troubleshooting — symptom-first fixes
Understand it
- Supported Protocols — per-protocol ports, ciphers, stealth
- Architecture — container topology and bundle flow
- Threat Model — what is and is not protected
- OPSEC Guide — operator-side hardening
Help out
- Support MoaV — run a server, contribute, translate, donate
- Translating the Docs — one page is a complete contribution
Running it with an AI agent? llms.txt is a compact
orientation for coding agents; llms-full.txt is the
whole corpus. Both ship as release assets.