From c31e17bb9d04586f03d9acf53663d6fe0927c8be Mon Sep 17 00:00:00 2001 From: Andrey Prokopyuk Date: Thu, 3 Sep 2026 19:25:59 +0300 Subject: [PATCH] Add MegaProxyServer docs links --- README.md | 4 +- docs/en/index.md | 403 +--------------------------------------------- docs/ru/index.md | 406 +---------------------------------------------- 3 files changed, 8 insertions(+), 805 deletions(-) diff --git a/README.md b/README.md index 5dac789..61661c8 100644 --- a/README.md +++ b/README.md @@ -183,8 +183,8 @@ After installation: 4. Tap **Test** to validate the connection, then tap **Connect**. 5. Optionally enable Always-on VPN in Android settings. -For production-ready HTTPS, SSH, and SSH-with-jump server configurations, see the -[English server guide](docs/en/index.md) or [Russian server guide](docs/ru/index.md). +Server configurations and setup instructions are maintained separately in +[MegaProxyServer](https://github.com/andre487/MegaProxyServer). ## Current limitations diff --git a/docs/en/index.md b/docs/en/index.md index efe01b0..3e43402 100644 --- a/docs/en/index.md +++ b/docs/en/index.md @@ -1,403 +1,6 @@ # MegaProxy server setup -[Русская версия](../ru/index.md) - -This guide describes production-oriented servers for MegaProxy on a current Ubuntu or Debian VPS. -It covers three transports: - -1. HTTPS proxy with TLS, Basic authentication, and HTTP/2. -2. Direct SSH transport. -3. SSH through a dedicated jump host. - -The examples favor standard protocols, a small attack surface, automatic certificate renewal, and -predictable recovery after a reboot. Replace every value written as `EXAMPLE_VALUE` before using a -configuration. - -## Choose the topology - -| Profile type | Public servers | Public ports | Best use | -| --- | ---: | --- | --- | -| HTTPS | 1 | TCP 443 and TCP 80 for certificate issuance | Efficient HTTP/2 multiplexing and simple credentials | -| SSH | 1 | TCP 22, or another chosen SSH port | Standard OpenSSH deployment and key authentication | -| SSH with Jump | 2 | Jump: TCP 22; destination: SSH reachable from jump | Separating the public entry point from the egress server | - -Use different providers or networks for failover profiles. A second profile on the same VM does -not protect against a VM, provider, route, or datacenter failure. - -## Common server baseline - -The commands below assume a fresh server and a sudo-capable administrator account. Keep the -existing administrator SSH session open until a second session has successfully connected. - -```shell -sudo apt update -sudo apt full-upgrade -sudo apt install --yes ca-certificates curl openssl ufw unattended-upgrades -sudo systemctl enable --now unattended-upgrades -``` - -Set an accurate clock; TLS and SSH diagnostics become confusing when it is wrong: - -```shell -timedatectl status -sudo systemctl enable --now systemd-timesyncd -``` - -Apply a default-deny inbound firewall policy and open only the ports required by the selected -topology. Check the provider's network firewall as well as the OS firewall. - -```shell -sudo ufw default deny incoming -sudo ufw default allow outgoing -sudo ufw allow 22/tcp -sudo ufw enable -sudo ufw status verbose -``` - -Before changing the SSH port, first open the new port and verify a new connection. Never remove the -only working administrative path to the server. - -## HTTPS with HTTP/2 - -This setup uses [GOST v3](https://v3.gost.run/en/), whose HTTP/2 proxy mode accepts CONNECT streams -over TLS. MegaProxy negotiates `h2` with ALPN and reuses the HTTP/2 connection for multiple tunnels. - -### 1. Prepare DNS and the firewall - -Create an `A` record such as `proxy.example.com` pointing to the server. Add an `AAAA` record only -if the server has working public IPv6. Wait until public DNS returns the new address. - -```shell -sudo ufw allow 80/tcp -sudo ufw allow 443/tcp -``` - -Port 80 is used only for the ACME HTTP challenge. Keep it available so certificates can renew. - -### 2. Obtain a public certificate - -Install Certbot and request a certificate while port 80 is unused: - -```shell -sudo apt install --yes certbot -sudo certbot certonly --standalone \ - --domain proxy.example.com \ - --agree-tos \ - --email admin@example.com \ - --no-eff-email -sudo certbot renew --dry-run -``` - -Certbot installations normally configure automatic renewal. MegaProxy validates the system CA, -hostname, and validity dates but does not pin a particular certificate, so routine renewal works -without changing the profile. - -### 3. Install GOST - -Use a versioned GOST v3 binary or container from the -[official releases](https://github.com/go-gost/gost/releases). Verify its published checksum and -avoid unversioned third-party packages. The container example below keeps the installation easy to -audit: - -```shell -sudo apt install --yes docker.io -sudo systemctl enable --now docker -sudo install -d -m 0700 /opt/megaproxy -``` - -Generate a long random password locally and store it in a password manager: - -```shell -openssl rand -base64 32 -``` - -Create `/opt/megaproxy/gost.yml`: - -```yaml -services: - - name: megaproxy-h2 - addr: ":443" - handler: - type: http2 - auth: - username: EXAMPLE_USERNAME - password: EXAMPLE_LONG_RANDOM_PASSWORD - listener: - type: http2 - tls: - certFile: /etc/letsencrypt/live/proxy.example.com/fullchain.pem - keyFile: /etc/letsencrypt/live/proxy.example.com/privkey.pem - options: - minVersion: VersionTLS12 - maxVersion: VersionTLS13 - alpn: - - h2 -``` - -Protect the configuration because it contains the Basic Auth password: - -```shell -sudo chmod 600 /opt/megaproxy/gost.yml -``` - -Do not configure GOST's `mitm`, protocol sniffing, Web API, metrics endpoint, or profiling endpoint. -MegaProxy needs only CONNECT forwarding, and these features are unnecessary for this deployment. - -Start a pinned GOST release. Replace `EXAMPLE_GOST_VERSION` with a reviewed v3 release tag: - -```shell -sudo docker run --detach \ - --name megaproxy-gost \ - --restart unless-stopped \ - --network host \ - --volume /opt/megaproxy/gost.yml:/etc/gost/gost.yml:ro \ - --volume /etc/letsencrypt:/etc/letsencrypt:ro \ - --env GOST_LOGGER_LEVEL=warn \ - gogost/gost:EXAMPLE_GOST_VERSION \ - -C /etc/gost/gost.yml -``` - -Inspect startup without publishing credentials: - -```shell -sudo docker ps --filter name=megaproxy-gost -sudo docker logs --tail 100 megaproxy-gost -``` - -Reload the renewed certificate by restarting the small container. Create -`/etc/letsencrypt/renewal-hooks/deploy/restart-megaproxy-gost`: - -```shell -#!/bin/sh -exec /usr/bin/docker restart megaproxy-gost -``` - -Then secure and test the hook: - -```shell -sudo chmod 750 /etc/letsencrypt/renewal-hooks/deploy/restart-megaproxy-gost -sudo certbot renew --dry-run -``` - -### 4. Verify and add the profile - -Confirm certificate verification and HTTP/2 ALPN from another machine: - -```shell -openssl s_client \ - -connect proxy.example.com:443 \ - -servername proxy.example.com \ - -alpn h2 \ - -verify_return_error