MotherofallVPNs/MoaV v2.3.0-rc.4

v2.3.0-rc.4 — EXPERIMENTAL, not for production use

on GitHub

⚠️ Prerelease for testing — not for production. Stable moav update will not pull this; install it explicitly (below). This is rc.4: rc.3 plus the XDNS/Xray-26.9 compatibility fix that the rc.3 e2e surfaced.

Added in 2.3.0

• sing-box → 1.14.0 (all pins). Config unchanged; validated against the real 1.14 sing-box check / format, with new CI gates that render the config and run the real binary. (#329)
• Snell — new protocol, ON by default. Lightweight TCP proxy, HTTP obfs, no TLS/domain. Shared-key (one PSK for all users, like the DNS tunnels), so revoking a user needs a key rotation + re-issue. Needs a Snell v5 client — Surge 5 / Stash / Clash Mi / Mihomo / Clash Meta for Android / FlClash (not v2rayNG/Hiddify). (#329)
• Hysteria2 gecko obfuscation — opt-in via HYSTERIA2_OBFS_TYPE=gecko; better DPI resistance, needs a client core of sing-box ≥ 1.14 or hysteria ≥ 2.9.2. (#329)

Changed — component bumps

• Grafana 13.2.0 → 13.2.1 — upstream security fixes (CVE-2026-12704, CVE-2026-14199).
• telemt 3.5.5 → 3.5.7, Xray-core v26.7.28 → v26.9.9, slipstream → v2026.04.22.1, MasterDNS → v2026.06.13.
• TrustTunnelClient held at 1.0.49 (its 1.1.5 QUIC-stack swap needs a client/server compat test first). (#332)

Fixed

• XDNS made compatible with Xray ≥ 26.9 (new in rc.4). The Xray 26.9.9 bump above began rejecting a VLESS outbound without TLS/encryption to a bare public IP, so xray refused to start and XDNS failed the rc.3 e2e. The XDNS client configs now use a domain as the nominal VLESS address (the real routing IPs stay literal inside finalmask.resolvers), which also unblocks XDNS for anyone on an already-updated Xray client.
• moav update "Discard changes" now fully resets with git reset --hard. (#329)
• moav update -b <ref> accepts a tag, so moav update -b v2.3.0-rc.4 works. (#331)
• .env inline-comment leak fixed — new options added by moav update no longer fold a trailing # comment into the value (the AmneziaWG-port bug class). (#331)
• Telegram release notification pins its link preview to the release page. (#331)

Rolls up everything in 2.2.4.

Install / upgrade for testing

# fresh install on a throwaway server:
curl -fsSL moav.sh/install.sh | bash -s -- -b v2.3.0-rc.4
# or upgrade an existing test box:
moav update -b v2.3.0-rc.4 && moav build && moav start
moav doctor && moav test <user>

Please report

image build failures (esp. the bumped components), any protocol that fails moav test (esp. XDNS), Snell connection issues (v5 clients), or moav update problems.

Changes since rc.3: v2.3.0-rc.3...v2.3.0-rc.4
Full diff since stable: v2.2.4...v2.3.0-rc.4

Note: the install command below fetches the latest stable release, not
this candidate. To try this build specifically, use the git checkout steps in
the notes above.

Quick Install

curl -fsSL https://moav.sh/install.sh | bash

This will install MoaV to /opt/moav and guide you through setup.

Documentation

moav.sh/docs — full documentation

Get started

• Quick Start — install to first user in ~10 minutes
• Client Setup — connect from phones and desktops
• DNS Configuration — records, delegations, freeing port 53

Reference

• CLI Reference — every command and flag
• Setup Guide — every option, in depth
• Monitoring — Grafana dashboards and metrics
• Troubleshooting — symptom-first fixes

Understand it

• Supported Protocols — per-protocol ports, ciphers, stealth
• Architecture — container topology and bundle flow
• Threat Model — what is and is not protected
• OPSEC Guide — operator-side hardening

Help out

• Support MoaV — run a server, contribute, translate, donate
• Translating the Docs — one page is a complete contribution

Running it with an AI agent? llms.txt is a compact
orientation for coding agents; llms-full.txt is the
whole corpus. Both ship as release assets.

Community

Telegram · X · Issues · moav.sh