255caeb069
fix: server health ping, rate limiting, security hardening, DA backoff
...
- Server health ping every 30s — dead servers excluded from all API calls, auto-recovered when back online
- Fixed py3xui client.delete() argument order (inbound_id first, client_uuid second)
- Rate limiting on /admin/login (max 10 attempts per 60s per IP)
- XSS prevention: HTML-escape all user-controlled fields in templates
- CSP headers on all HTML pages (CSP, X-Frame-Options, X-Content-Type-Options)
- CORS restricted to configured host instead of wildcard
- Secure + SameSite=Lax cookie flags for admin_token
- Bind to 127.0.0.1 instead of 0.0.0.0
- Async locks for global state (last_donation_id)
- Graceful shutdown: all background tasks cancelled on exit
- DA polling exponential backoff: 1s→max 1h, immediate 1h on 401
2026-06-16 21:23:03 +00:00
d1f018dba1
docs: update README — wdtt/Zern-BlackOut compat, new repo URL, propagate, health, trojan
2026-06-07 10:42:44 +00:00
1f3308fbb8
fix: clear subscription cache on user tier/plan update
2026-06-07 09:57:56 +00:00
04828f0e0d
fix: use absolute tariff_end_at for expire_ts instead of now+remaining
2026-05-23 14:34:41 +00:00
09f1b7b261
fix: dynamic days remaining via tariff_end_at timestamp; auto-downgrade when expired
2026-05-23 14:27:43 +00:00
dc6d1212d6
fix: capture all proxy link schemes (trojan, vless, vmess, ss) in fetch_vless_links
2026-05-22 05:53:12 +00:00
9a893d5e6d
fix: add Trojan protocol support in create_3xui_client (password instead of uuid)
2026-05-22 05:48:15 +00:00
dc92b75387
fix: per-inbound propagate check for new inbounds on existing servers
2026-05-22 05:45:38 +00:00
4640262a14
feat: extract templates to web/ folder, add PL-test server, auto-propagate, health scoring, admin dashboard redesign
2026-05-21 18:23:41 +00:00
deee704e01
feat: restructure home page into 4 sections, add uptime tracking, remove service icons
2026-05-20 18:37:15 +00:00
6bb8cdbe18
feat: redesign home page — Material glassmorphism, staggered animations, custom typography
2026-05-20 18:26:27 +00:00
a918f669e5
feat: new home page with server status bars, client count, tech info
2026-05-20 18:09:36 +00:00
e855c30285
refactor: is_free only per-inbound, remove server-level check
2026-05-20 17:44:11 +00:00
0771b300e5
fix: match links to inbounds by index instead of grouping all inbound names
2026-05-20 16:54:03 +00:00
ffb980536d
fix: webhook now uses dynamic config, add webhook_secret validation
2026-05-17 08:46:21 +00:00
b48b3b5730
fix: read prices from config instead of hardcoded values
2026-05-17 08:35:32 +00:00
e2c3872fe3
fix: make BASE_DIR dynamic so script works from any directory
2026-05-16 16:51:06 +00:00
ac70aaae03
Initial release: soft-tariff multi-server VPN aggregator with Happ support
2026-05-16 16:45:47 +00:00
SashegDev