This release adds a deliberately small OpenWrt integration without changing the
proxy protocol or Rust configuration surface.
New
- A one-line OpenWrt installer uses the existing static musl release archives and
mapsDISTRIB_ARCHto AArch64, ARMv7, MIPS, MIPSel or x86_64. --upxexplicitly selects the existing flash-saving UPX archive; the regular
binary remains the default.luci-app-tg-ws-proxyprovides UCI/procd integration, a page under
Services → Telegram WS Proxy, service controls and a filtered livelogd
view.- OpenWrt 25.12+ receives an architecture-independent APK; OpenWrt 24.10 receives
the corresponding IPK. - Stable and beta release channels are supported by the same installer and
release workflow.
Distribution model
The proxy binary is not repackaged as APK/IPK. Release CI builds the normal musl
binaries once, publishes regular and UPX archives, and separately builds only the
architecture-independent LuCI integration from one standard OpenWrt package
recipe. A shared SHA256SUMS covers the Linux archives and both LuCI packages.
The unsigned LuCI APK is installed with an explicit --allow-untrusted policy
after verification against the immutable digest from the GitHub release API.
Download mirrors can provide payloads but cannot override expected digests. IPK
installation does not require an architecture bypass.
Upgrade safety
Before replacing /usr/bin/tg-ws-proxy, the installer verifies asset digests,
extracts the selected archive and executes its --version command. It backs up
the existing binary, UCI config and service state, performs an atomic binary
replacement, then verifies procd and the listening socket. Failed binary startup
restores the previous binary/config/service state. The UCI config is restricted
to mode 0600, and only the three newest installer backups are kept after a
successful installation.
One-time secret generation and logging migration run during installation rather
than mutating UCI from the normal service start path.