valnesfjord/tg-ws-proxy-rs v2.6.1

tg-ws-proxy-rs v2.6.1

on GitHub

OpenWrt service privileges

• Run the OpenWrt proxy under a dedicated service user and group instead of
  root. If that account is missing or invalid, startup fails instead of
  silently falling back to root.
• Preserve MTProto and SOCKS5 listeners on ports below 1024: procd uses ujail
  to grant the proxy only CAP_NET_BIND_SERVICE for those configurations. The
  default ports need no effective capabilities. The profile is independent of
  the raw binary and survives binary replacement.
• Restore the previous init script and capability profile on a failed upgrade,
  and reinstall the LuCI package on the next attempt if necessary. The
  installer identifies the proxy separately from ujail's supervisor.

The LuCI package now depends on procd-ujail. On a privileged port, ujail
remains as a root-owned supervisor; the proxy runs without root. This does not
add filesystem or network namespace isolation. A rollback to a previous
root-running release restores that release's original privileges.