aaaamoooo
ad18e16ac6
One credential set per customer (UUID + 32-byte root relay key + shortId)
lives on the customer record; node bindings no longer store credentials.
SS2022 user keys derive deterministically from the root key by method
length (16/24/32-byte prefix), so a single password serves every protocol,
matching 3x-ui's per-client credential model. Reality public keys stay a
node property and are shown per binding in the credentials pane.
- store: load-time convergence — first binding's set wins; a converged
password that is not a 32-byte root key is regenerated (uuid/shortId
preserved); bindings are stripped; idempotent, covered by tests
- deploy: the orchestrator stamps the customer's set onto a build copy;
subscriptions resolve the same set; the derivation applies in both the
inbound builder and the URI builder (verified live: Alice's N1 link is
byte-identical to the pre-change seed expectation, her N2 user key is
exactly the root key's 16-byte prefix)
- API: GET /api/customers/:id/credentials returns {credentials, bindings};
regenerate is now POST /api/customers/:id/credentials/regenerate and
rotates the whole set, rebuilding every deployed node of the customer
- UI: credentials pane shows the single shared set plus per-binding
node/protocol/Reality-public-key rows
- golden subscriptions fixture regenerated under one shared set (RF and
SS entries byte-identical to before; five entries audited by hand)
- golden baseline re-captured for the new shapes; difftest normalizer now
treats a base64 root key's prefix-truncation encodings and the Surge
'='-mangled variants as the same secret
NexusGate（二开版）
基于 NexusGate v0.6.8 的二次开发：3x-ui 式共享节点 + 全面 sing-box 化。主控面板和 Agent 弃用 xray，只用 sing-box，内存占用大幅降低。
架构
- 主控：Node.js 面板（约 61MB），跑在 OpenWrt 路由器或任意 Linux 上。管理节点、客户、订阅，下发配置到各 Agent。
- Agent：跑在节点机上，通过 token 注册。管理 sing-box 进程，上报心跳和按用户流量。
与原版的区别
- 移除 VMess 协议
- 3x-ui 式共享节点：nodes 状态机 + 每个客户独立凭据（
ng:<customerId>身份） - 全面 sing-box：不再捆绑 xray
- 按用户流量统计：AnyTLS 走日志解析，SS 走节点级
- 内存优化：面板
node --max-old-space-size=128 --optimize-for-size；Agent 为 Go 静态二进制（约 12MB，节点机无需 Node.js）；sing-boxGOMEMLIMIT=64MiB GOGC=50
安装
主控
# 克隆仓库
git clone https://git.881218.xyz/rogue/NexusGate.git /opt/nexusgate
cd /opt/nexusgate
# 安装依赖并启动
node --max-old-space-size=128 --optimize-for-size server.js
面板地址：http://IP:8787，默认账号 admin。
OpenWrt 上用 procd 常驻，见 scripts/ 目录。
Agent（节点机）
- 在主控面板「服务器」→「添加设备」，填好节点信息
- 点该设备的「注册」按钮，复制弹出的一次性注册命令（token 30 分钟内有效）
- 在节点机上以 root 运行该命令
curl -fsSL https://git.881218.xyz/rogue/NexusGate/raw/branch/main/scripts/agent-install.sh | bash -s -- --server https://主控域名 --token 你的TOKEN
Agent 是 Go 静态二进制，安装时从 Gitea Release 下载，节点机不再需要安装 Node.js。（如需回退旧版 Node Agent，安装时加环境变量 NG_AGENT_IMPL=node。）
支持的协议
VLESS / SS2022 / SS经典 / SOCKS5 / Hysteria2 / AnyTLS
内存占用（实测 2026-10-20，三台节点机）
| 组件 | 内存 |
|---|---|
| 主控面板 | 约 61MB（OpenWrt 路由器） |
| Agent | 约 12MB（Go 静态二进制） |
| sing-box | 16–36MB |
License
继承上游 NexusGate