MotherofallVPNs/MoaV v2.3.0-rc.3

v2.3.0-rc.3 — EXPERIMENTAL, not for production use

on GitHub

⚠️ Prerelease for testing — not for production. Stable moav update will not pull this; install it explicitly (below). This is rc.3: rc.2 plus the component bumps that were originally staged for 2.3.1, folded in so the Grafana security patch ships with 2.3.0 and everything is tested together.

Added in 2.3.0

• sing-box → 1.14.0 (all pins). Config unchanged; validated against the real 1.14 sing-box check / format, with new CI gates that render the config and run the real binary. (#329)
• Snell — new protocol, ON by default. Lightweight TCP proxy, HTTP obfs, no TLS/domain. Shared-key (one PSK for all users, like the DNS tunnels), so revoking a user needs a key rotation + re-issue. Needs a Snell v5 client — Surge 5 / Stash / Clash Mi / Mihomo / Clash Meta for Android / FlClash (not v2rayNG/Hiddify). (#329)
• Hysteria2 gecko obfuscation — opt-in via HYSTERIA2_OBFS_TYPE=gecko; better DPI resistance, needs a client core of sing-box ≥ 1.14 or hysteria ≥ 2.9.2. (#329)

Changed — component bumps (new in rc.3)

• Grafana 13.2.0 → 13.2.1 — upstream security fixes (CVE-2026-12704, CVE-2026-14199).
• telemt 3.5.5 → 3.5.7, Xray-core v26.7.28 → v26.9.9, slipstream → v2026.04.22.1, MasterDNS → v2026.06.13.
• TrustTunnelClient held at 1.0.49 (its 1.1.5 QUIC-stack swap needs a client/server compat test first). (#332)

Fixed

• moav update "Discard changes" now fully resets with git reset --hard, so staged local changes no longer block the pull. (#329)
• moav update -b <ref> accepts a tag, not only a branch — so moav update -b v2.3.0-rc.3 works. (#331)
• .env inline-comment leak fixed. New options added by moav update no longer carry a trailing # comment into the value (the AmneziaWG-port bug class); notes moved above each variable, the append strips defensively, and a CI lint keeps it clean. (#331)
• Telegram release notification pins its link preview to the release page, instead of the first external link in the notes body. (#331)

Rolls up everything in 2.2.4 (bulk revoke, donation quota resume, Claude PR/issue automation, and earlier component bumps).

Install / upgrade for testing

# fresh install on a throwaway server:
curl -fsSL moav.sh/install.sh | bash -s -- -b v2.3.0-rc.3
# or upgrade an existing test box:
moav update -b v2.3.0-rc.3 && moav build && moav start
moav doctor && moav test <user>

Please report

image build failures (esp. the bumped components), any protocol that fails moav test, Snell connection issues (v5 clients), or moav update problems.

Changes since rc.2: v2.3.0-rc.2...v2.3.0-rc.3
Full diff since stable: v2.2.4...v2.3.0-rc.3

Note: the install command below fetches the latest stable release, not
this candidate. To try this build specifically, use the git checkout steps in
the notes above.

Quick Install

curl -fsSL https://moav.sh/install.sh | bash

This will install MoaV to /opt/moav and guide you through setup.

Documentation

moav.sh/docs — full documentation

Get started

• Quick Start — install to first user in ~10 minutes
• Client Setup — connect from phones and desktops
• DNS Configuration — records, delegations, freeing port 53

Reference

• CLI Reference — every command and flag
• Setup Guide — every option, in depth
• Monitoring — Grafana dashboards and metrics
• Troubleshooting — symptom-first fixes

Understand it

• Supported Protocols — per-protocol ports, ciphers, stealth
• Architecture — container topology and bundle flow
• Threat Model — what is and is not protected
• OPSEC Guide — operator-side hardening

Help out

• Support MoaV — run a server, contribute, translate, donate
• Translating the Docs — one page is a complete contribution

Running it with an AI agent? llms.txt is a compact
orientation for coding agents; llms-full.txt is the
whole corpus. Both ship as release assets.

Community

Telegram · X · Issues · moav.sh