Merge pull request #103 from shayanb/dev

v1.8.0 — Full MahsaNG v16, parallel DNS tunnels, V2Ray subscription, and low-RAM hardening

Author: shayanb

.env.example

@@ -39,22 +39,36 @@ ENABLE_HYSTERIA2=true
 # Refs: github.com/shayanb/MoaV/issues/93
 ENABLE_SS=false
 ENABLE_WIREGUARD=true
-# dnstt/Slipstream enabled by default — broader client ecosystem than XDNS
-# (standalone binaries on 25+ platforms vs FinalMask-aware Xray clients like Happ)
+# dnstt/Slipstream/MasterDNS all enabled by default — broader client ecosystem
+# than XDNS (standalone binaries on 25+ platforms vs FinalMask-aware Xray clients
+# like Happ). All three run in parallel: dns-router fans queries out by subdomain
+# suffix (t./s./m.) so they share port 53 with no conflict. Each needs its own
+# NS record (DNSTT_SUBDOMAIN / SLIPSTREAM_SUBDOMAIN / MASTERDNS_SUBDOMAIN below).
 ENABLE_DNSTT=true
 ENABLE_SLIPSTREAM=true
+# MasterDNS - advanced DNS tunnel (ARQ + resolver LB), bundled in MahsaNG v16.
+# Adds a container. Coexists with dnstt/Slipstream via dns-router on its own
+# subdomain (MASTERDNS_SUBDOMAIN) — no port conflict. Set to false to opt out.
+ENABLE_MASTERDNS=true
 ENABLE_TRUSTTUNNEL=true
 ENABLE_TELEMT=true
 ENABLE_AMNEZIAWG=true
 ENABLE_ADMIN_UI=true
 ENABLE_CONDUIT=true
 ENABLE_SNOWFLAKE=true
+# GooseRelay - SOCKS5 over Google Apps Script -> this VPS exit (MahsaNG v16).
+# Opt-in: adds a container + needs PORT_GOOSE reachable from Google's network.
+# The Apps Script forwarder + client are set up by the end user.
+ENABLE_GOOSERELAY=false
 # VLESS+XHTTP+Reality via Xray-core
 ENABLE_XHTTP=true
 # XDNS - DNS tunnel via Xray mKCP+FinalMask (modern, per-user auth)
-# Disabled by default — requires FinalMask-aware client (Happ, Xray CLI)
-# NOTE: XDNS and dnstt/Slipstream both need port 53. Use `moav switch-dns` to swap.
-ENABLE_XDNS=false
+# Disabled by default — requires FinalMask-aware client (Happ, Xray CLI).
+# When enabled, dns-router routes x.<DOMAIN> → xray:5355 alongside dnstt/Slipstream/MasterDNS.
+# All four DNS tunnels run simultaneously on port 53 — no `moav switch-dns` needed.
+# Requires NS record: x.<DOMAIN> → dns.<DOMAIN> (see DNS Setup Step 5).
+# Requires FinalMask-aware client (Happ, Xray CLI) to actually use XDNS.
+ENABLE_XDNS=true
 # Grafana monitoring (requires 2GB+ RAM) — leave unset to be prompted during bootstrap
 #ENABLE_MONITORING=
 
@@ -63,7 +77,7 @@ ENABLE_XDNS=false
 # =============================================================================
 
 # sing-box - https://github.com/SagerNet/sing-box/releases
-SINGBOX_VERSION=1.12.23
+SINGBOX_VERSION=1.13.12
 
 # wstunnel - https://github.com/erebe/wstunnel/releases
 WSTUNNEL_VERSION=10.5.5
@@ -94,6 +108,15 @@ TELEMT_VERSION=3.4.11
 # Tag list: https://repo.or.cz/dnstt.git/tags
 DNSTT_VERSION=v1.20260501.0
 
+# MasterDNS (advanced DNS tunnel) - https://github.com/masterking32/MasterDnsVPN
+# This build matches the MasterDNS component bundled in MahsaNG v16.
+MASTERDNS_VERSION=v2026.05.10.180256-27c7e11
+
+# GooseRelay (SOCKS5 over Google Apps Script) - https://github.com/kianmhz/GooseRelayVPN
+# v1.7.1 — fully interoperable with the GooseRelay client bundled in MahsaNG v16
+# (v1.7.x ↔ v1.6.x wire/config compatible per upstream).
+GOOSERELAY_VERSION=v1.7.1
+
 # Xray-core (VLESS+XHTTP+Reality+XDNS) - https://github.com/XTLS/Xray-core/releases
 # Built from source for latest FinalMask/XDNS support
 XRAY_VERSION=v26.5.9
@@ -125,7 +148,10 @@ CLASH_EXPORTER_VERSION=0.0.4
 # tries Google first (fast for most), then goproxy.cn (not subject to Google's
 # CDN limits), then direct VCS. Override with your own Athens mirror or set to
 # "https://proxy.golang.org,direct" to force Google-only.
-GOPROXY=https://proxy.golang.org|https://goproxy.cn|direct
+# Quoted because the value is pipe-separated — without quotes, any script that
+# `source`s this file would parse the `|` as shell pipes. Docker Compose strips
+# the surrounding quotes when passing it as a build arg.
+GOPROXY="https://proxy.golang.org|https://goproxy.cn|direct"
 # GOSUMDB=off avoids a second hard dependency on Google's checksum server
 # (sum.golang.org), which is unreachable from the same networks that get 403s
 # above. Module integrity is still verified against the go.sum committed in each
@@ -164,7 +190,7 @@ REALITY_PRIVATE_KEY=
 XHTTP_REALITY_TARGET=dl.google.com:443
 
 # =============================================================================
-# DNS TUNNEL CONFIGURATION (dnstunnel profile: dnstt + Slipstream)
+# DNS TUNNEL CONFIGURATION (dnstunnel profile: dnstt + Slipstream + MasterDNS)
 # =============================================================================
 
 # Subdomain for dnstt DNS tunnel (NS record must point to this server)
@@ -175,6 +201,12 @@ DNSTT_SUBDOMAIN=t
 # Full tunnel domain: ${SLIPSTREAM_SUBDOMAIN}.${DOMAIN} (e.g., s.example.com)
 SLIPSTREAM_SUBDOMAIN=s
 
+# Subdomain for MasterDNS tunnel (NS record must point to this server)
+# Full tunnel domain: ${MASTERDNS_SUBDOMAIN}.${DOMAIN} (e.g., m.example.com)
+# Enabled by default. Shares port 53 with dnstt/Slipstream via dns-router
+# (routed by subdomain) — no extra port needed.
+MASTERDNS_SUBDOMAIN=m
+
 # Subdomain for XDNS tunnel (NS record must point to this server)
 # Full tunnel domain: ${XDNS_SUBDOMAIN}.${DOMAIN} (e.g., x.example.com)
 XDNS_SUBDOMAIN=x
@@ -287,16 +319,16 @@ PORT_HTTPS=443       # Reality (VLESS) + Hysteria2 (UDP)
 PORT_TROJAN=8443     # Trojan fallback
 PORT_WIREGUARD=51820 # WireGuard (UDP)
 PORT_WSTUNNEL=8080   # WebSocket tunnel for WireGuard
-# NOTE: PORT_DNS and PORT_XDNS both default to 53 — only one group can be active
-PORT_DNS=53          # dnstt + Slipstream (via dns-router) — enabled by default
-PORT_XDNS=5353       # XDNS (direct to xray) — set to 53 if switching to XDNS via `moav switch-dns xdns`
+PORT_DNS=53          # dns-router public port — all DNS tunnels share this (dnstt/Slipstream/MasterDNS/XDNS)
+PORT_XDNS=5356       # xray XDNS secondary host port — dns-router forwards internally to xray:5355
 PORT_ADMIN=9443      # Admin dashboard
 PORT_CDN=2082        # CDN WebSocket (VLESS+WS)
 PORT_AMNEZIAWG=51821 # AmneziaWG (obfuscated WireGuard, UDP)
 PORT_TRUSTTUNNEL=4443 # TrustTunnel (HTTP/2 + QUIC)
 PORT_TELEMT=993      # Telegram MTProxy (fake-TLS on IMAPS port)
 PORT_XHTTP=2096      # XHTTP (VLESS+XHTTP+Reality via Xray-core)
 PORT_SS=8388         # Shadowsocks-2022 (only used when ENABLE_SS=true)
+PORT_GOOSE=8444      # GooseRelay exit endpoint (only if ENABLE_GOOSERELAY=true)
 PORT_GRAFANA=9444    # Grafana monitoring dashboard
 
 # Shadowsocks-2022 cipher (AEAD-2022 family). MoaV runs SS-2022 in multi-user

.gitignore

@@ -83,6 +83,21 @@ configs/slipstream/key.pem
 # Telegram MTProxy (telemt) generated files
 configs/telemt/config.toml
 
+# MasterDNS generated files (server_config.toml, server.domain, keys, …).
+# Ignore everything bootstrap/entrypoint writes here; keep only .gitkeep.
+configs/masterdns/*
+!configs/masterdns/.gitkeep
+
+# GooseRelay generated files (server_config.json, …). Keep .gitkeep and the
+# vendored Apps Script template; ignore everything else generated at runtime.
+configs/gooserelay/*
+!configs/gooserelay/.gitkeep
+!configs/gooserelay/Code.gs.template
+
+# Conduit lifetime rules — runtime-rewritten by update-conduit-offsets.sh.
+# Materialized from the committed .template on first monitoring start.
+configs/monitoring/conduit_lifetime.rules.yml
+
 # DNS router
 configs/dns-router/