Share-link standard §4.3.19 supports extra= (URL-encoded XHttpObject JSON),
and passwall exposes it as XHTTP Extra. Verified end-to-end with real xray
v26.3.27 + caddy: matching client+server extra → 204 through the full TLS
h2 chain. Default off because a client that ignores the extra param gets
400 from a padding-enabled server.
Also correct the previous claim that links can't carry extra.
Co-Authored-By: Claude <noreply@anthropic.com>
End-to-end matrix with real xray v26.3.27 + caddy:
- server with extra padding + plain client: 400 (direct AND via caddy)
- server without extra + plain client: 204 (direct AND via caddy, TLS h2)
Padding placement/key names must match on both ends, but share links cannot
carry these params and mainstream clients can't configure them — so a
server-side-only extra block rejects every real client. Removed from the
template along with XPADDING_HEADER/XPADDING_KEY.
Co-Authored-By: Claude <noreply@anthropic.com>
www.people.com answers every non-browser request with a Cloudflare JS
challenge (cf-mitigated: challenge) — the masquerade instantly fails
active probing, and the open reverse proxy gets the VPS IP flagged by
CF for scraping. engineersblog.net serves real 200 content without a
challenge; using the same target as the Xray fallback makes 443 and
8443 present the same site, which strengthens the disguise.
Co-Authored-By: Claude <noreply@anthropic.com>
Verified against Cloudflare docs: ECH is enabled by default on Free zones
(no toggle shown); Always Use HTTPS does not loop with Caddy's one-way
http->https redirect; Minimum TLS 1.0->1.2 is a free hardening; HTTP/3
toggle lives under Network; ACM is unrelated paid addon.
Co-Authored-By: Claude <noreply@anthropic.com>
Host/SNI/DNS-record overrides in Origin Rules are Enterprise-only (greyed
out on free plans). The architecture never needed them: CF origins with
SNI/Host=CDN_DOMAIN, Xray REALITY falls through to Caddy, and Caddy's CDN
site block matches on that SNI directly. Guide now says leave everything
at Preserve.
Co-Authored-By: Claude <noreply@anthropic.com>
DNS grey/orange split for REALITY vs CDN domains, Full (strict) mode,
Origin Rule (Host/SNI/DNS override to DOMAIN), ECH/Always-Use-HTTPS/HTTP3,
WebSockets toggle, common pitfalls, and minimal firewall port list.
Also dedup ECH paragraph in optional-enhancements (points to the guide).
Co-Authored-By: Claude <noreply@anthropic.com>
Install is already idempotent-upgrade (apt install caddy / xray install script /
get.hy2.sh all fetch latest); upgrade mode additionally requires an existing
setup.env (dies instead of accidentally installing) and never prompts.
Legacy setup.env without HY2_CERT_MODE infers dns when CF_API_TOKEN present,
so upgrades keep wildcard certs instead of silently switching to http mode.
Co-Authored-By: Claude <noreply@anthropic.com>
hy2 certmagic HTTP-01 listens only on 127.0.0.1:9180 (altPort); Caddy's
port-80 block reverse-proxies /.well-known/acme-challenge/ to it. Non-wildcard
DOMAIN cert, auto-renewed and hot-applied, no DNS API token needed, no new
public ports. TLS-ALPN is unusable (CA only connects to TCP 443 = Xray) and
reusing Caddy's cert files needs permission/copy hooks, so HTTP-01 is the
minimal stable default. HY2_CERT_MODE=dns keeps Cloudflare DNS-01 wildcard
as fallback (CF_API_TOKEN required only in dns mode).
Co-Authored-By: Claude <noreply@anthropic.com>
A 404 from <team>.cloudflareaccess.com/warp means the team domain does
not exist (misspelled team name) — print that explicitly and suggest
copying the team name from Zero Trust > Settings instead of typing it.
README FAQ updated accordingly.
Co-Authored-By: Claude <noreply@anthropic.com>
- README.md: step-by-step dashboard guide using current navigation
(Access controls > Service credentials > Service Tokens;
Team & Resources > Devices > Management > Device enrollment
permissions), incl. the two classic pitfalls: policy Action must be
Service Auth (not Allow), and Free plan still requires a payment
method on file. Also documents team name vs domain, verification,
FAQ (403/429, device seats, plain-WireGuard limitations), and the
supply-chain notes.
- Script: when the enrollment JWT fetch fails, print HTTP status and
the Location redirect target plus a 3-point checklist (Service Auth
vs Allow, policy not attached to enrollment permissions, bad/expired
credentials) — a 302 to /cdn-cgi/access/login/ is now immediately
recognizable as a wrong policy action.
Co-Authored-By: Claude <noreply@anthropic.com>
eli