v1.1.0

VPN Infrastructure

Protocols

• VLESS Reality Vision (port 443/tcp) — primary, best DPI resistance
• VLESS Reality gRPC (port 8446/tcp) — fallback, multiplexed HTTP/2
• Hysteria2 + Salamander (port 443/udp) — QUIC-based, obfuscated

What's New in v1.1.0

Cloudflare WARP Integration

• WARP as WireGuard endpoint chained through VPN proxy (client → VPN → WARP → internet)
• Solves datacenter IP blocks on services like OpenAI, Netflix, Disney+, Spotify
• WARP credentials managed as Terraform variables, deployed to GitHub environments

Smart Routing with clash_mode

• Rule (default) — automatic routing: RU sites → direct, OpenAI/Netflix/Disney+/Spotify → WARP, rest → VPN proxy
• Proxy — force all traffic through VPN
• Direct — bypass VPN entirely
• WARP — force all traffic through WARP
• Switchable from client UI (Hiddify, SFI, metacubexd)

Selective WARP Routing

• Only services that block datacenter IPs go through WARP (no extra hop for everything else)
• Rule sets: geosite-openai, geosite-netflix, geosite-disney, geosite-spotify
• Easy to extend — add rule sets to warpTags in route.libsonnet

DPI Resistance

• Vision moved to standard port 443 to avoid fingerprinting
• Ad blocking via geosite-category-ads-all rule set

Client Configs

• client-base — macOS/generic (TUN mode)
• client-linux — Linux with Docker bridge + mixed proxy
• client-mobile — iOS/Android (SFI/SFA/Hiddify)
• client-server — headless gateway (mixed + redirect proxy)

Infrastructure

• Terraform: Hetzner Cloud servers, Cloudflare DNS, GitHub Actions secrets
• CI/CD: GitHub Actions with reusable deploy workflows
• Configs: Jsonnet templates → envsubst → deploy via Docker Compose

v1.0.0

Initial stable release