getmeridian/meridian v4.0.0b1

Meridian 4.0.0b1 (beta)

on GitHub

Use a fresh server you can wipe. Meridian 4 cannot manage servers deployed by 3.x, and every user of a moved server needs a new link.

Try it next to 3.x

You need uv. Your 3.x command and ~/.meridian stay untouched:

alias meridian4='MERIDIAN_HOME="$HOME/.meridian-v4" uvx --prerelease allow --from meridian-vpn@latest meridian'
meridian4 deploy 198.51.100.10        # your server's IP

The alias always runs the newest beta. Then, from a device inside the censored network, run:

meridian4 test 198.51.100.10          # does real traffic pass from here?
meridian4 probe 198.51.100.10         # does the server look like a proxy from here?

Known gaps: a server you remove must still be reachable, or the change cannot finish; removing a node leaves Docker installed on it.

Tell us what you see

Open a Meridian 4 beta report. The most useful details: your country and network type (home ISP or mobile operator), whether your client app connects, and the output of meridian4 test. Outputs hide secrets, but replace IPs, domains, and links before posting.

Используйте новый сервер, который не жалко переустановить. Meridian 4 не управляет серверами, развёрнутыми через 3.x, а после переезда сервера всем его пользователям нужна новая ссылка.

Как попробовать рядом с 3.x

Нужен uv. Команда 3.x и папка ~/.meridian останутся как есть:

alias meridian4='MERIDIAN_HOME="$HOME/.meridian-v4" uvx --prerelease allow --from meridian-vpn@latest meridian'
meridian4 deploy 198.51.100.10        # IP вашего сервера

Алиас всегда запускает самую свежую бету. Затем с устройства внутри сети с блокировками выполните:

meridian4 test 198.51.100.10          # проходит ли реальный трафик отсюда?
meridian4 probe 198.51.100.10         # похож ли сервер на прокси, если смотреть отсюда?

Известные ограничения: удаляемый сервер должен быть доступен, иначе изменение не завершится; после удаления узла на сервере остаётся Docker.

Расскажите, что получилось

Откройте отчёт о бете Meridian 4. Важнее всего: страна и тип сети (домашний провайдер или мобильный оператор), подключается ли клиентское приложение, и вывод meridian4 test. Секреты в выводе скрыты, но перед публикацией замените IP-адреса, домены и ссылки.

[4.0.0] - Unreleased

Meridian 4 is a new foundation: the Remnawave panel replaces 3x-ui, and one
reviewed topology in ~/.meridian/cluster.yml describes your whole fleet.

Read first: this is not an in-place upgrade

• Meridian 4 cannot manage servers deployed by 3.x, and existing client links
  cannot carry over to Remnawave. Your 3.x servers keep working.
• To keep managing them, stay on 3.x: uv tool install 'meridian-vpn<4'.
• To move: deploy a fresh server with 4.0, give your users the new links, then
  meridian teardown the old server (it also removes 3x-ui).
• Requires Python 3.11+.

Deploy

• One command, verified end to end — meridian deploy IP sets up the panel
  and proxy, picks a camouflage target the server can actually use, pushes real
  traffic through the delivered subscription, and only then prints "Done" with a
  shareable connection page and QR code. Re-running it resumes or redeploys.
• Multi-server setups — meridian setup is a guided, resumable wizard for
  several exits, Realm relay chains, and routing gateways with failover.
• Review before change — meridian plan shows what meridian apply would do
  (exit 0 converged, 1 config error, 2 changes pending, 3 evidence unavailable).
• Optional paths — --domain adds XHTTP and WSS (Cloudflare CDN fallback);
  --hysteria2 adds Hysteria2 on UDP/443. Blocking Russian destinations stays on
  by default (--no-geo-block to turn it off).
• Shrink a running fleet — meridian node remove and meridian relay remove
  edit the topology, show every resource they will delete, and clean up the
  panel node, node container, Realm units, firewall rules, and published Hosts.
  meridian plan lists removals too, and the review covers them.
• Per-hop relay checks — meridian relay check confirms each Realm hop is
  running and reaches the next one, and that the public entry accepts connections.

Sharing

• Connection pages are built from each user's real subscription, so relays and
  every enabled protocol appear.
• Subscription links live under the connection-page path and never reveal the
  admin panel's address.
• meridian client add|show|list|remove|enable|disable. client remove deletes
  the user and their page; links stop working immediately.

Security and correctness

• No request logging on Meridian's web server; panel secrets are never rotated
  on restart; the live SSH port is never firewalled; teardown removes everything
  Meridian created and nothing it didn't (your own HAProxy/Caddy are left alone).
• meridian test and meridian probe are fail-closed: skipped evidence is never
  reported as a pass.
• Downloaded binaries (Xray, Realm, RealiTLScanner) are checksum-verified, and
  every container image is pinned to its tested multi-arch digest (amd64 and
  arm64), so a re-pushed tag cannot change what a fresh server runs.
• meridian update stays on the current major version; --major moves to the
  next one after you have read its release notes.

Remnawave versions

Fresh deploys install the versions below. Meridian requires at least backend
3.4.0 and never downgrades a Remnawave you upgraded yourself; it warns when the
running version is newer than the tested one.

Not yet available

• meridian studio (local web UI) is experimental and needs pip install 'meridian-vpn[studio]'.
  A running deploy can be cancelled; it stops after its current step and resumes on the next run.

Removed

• 3x-ui, HAProxy and Caddy support; per-server proxy.yml credentials.
• meridian fleet recover, apply --parallel/--prune-extras, and the
  desired_* lists in cluster.yml.