Repository navigation
feat(xray): add an Xray backend driven by the operator config - #3
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Backend.Suffix becomes Suffixes, clients.Existing takes a list, and USHER_DNS is parsed only when USHER_AWG_SOCKET is set. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Xray creates the lock as root with mode 0644, so the read-write open failed for usher and every pass reported Xray down. The example compose file now binds a host socket directory that usher can write. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Prepare returns structural validation errors so the pass skips Apply. Only x-usher hint, enroll and render errors still revoke. Drift compares the proxy type before Build and marks a failed comparison unusable, so no account reaches a handler of another type. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
checkDrift skipped every inbound with an error, so an x-usher typo let Apply revoke users from a running inbound it never compared with the file. Only structural errors skip the comparison now. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
usher managed AmneziaWG only. This adds an Xray backend: the operator owns Xray's
config.json, usher reads it read-only, keeps the users of the managed inbounds in step withusher.ymlthroughHandlerService, and writesclients/<user>/<tag>.jsonplus a share link<tag>.txt.USHER_AWG_SOCKETis required for the awg backend;users.jsonmoves to version 2 with ausers.json.v1backup. README has an upgrade section.docs/plans/completed/20261014-xray-config-backend.md.Verified:
go test -race ./...,scripts/format.sh, golden tests for 9 shapes, and the Xray e2e suite (connect, switch off, restart, hard kill, drift, certificate rewrite) on a Linux host with Xray 26.10.10. The awg e2e runs here in CI for the first time on this branch.