Wire Hysteria 2 UI with per-server SSL defaults and renew.

Expose domain/email on servers, warn that TCP 80/443 must be free on install, and allow Let's Encrypt re-issue from Hysteria settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -1,6 +1,6 @@
 # Amnezia Web Panel
 
-A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
+A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Hysteria 2**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
 
 > ### 🔄 Compatibility with Official Amnezia Client
 > 
@@ -62,6 +62,7 @@ Configuration panel for system parameters and preferences:
     *   **AmneziaWG (AWG / AWG 2.0 / AWG Legacy)**: Advanced WireGuard-based protocol with S3/S4 obfuscation to bypass deep packet inspection (DPI). Three coexisting variants — modern AWG 2.0 with full junk-packet masking, and a legacy variant for older clients.
     *   **Classic WireGuard**: Standard, high-performance WireGuard protocol for unmatched speed and broad device compatibility with traffic monitoring support.
     *   **Xray (XTLS-Reality)**: Stealthy protocol that masks VPN traffic as standard HTTPS browsing. Pinned to **Xray-core v26.x**; transparently reads both the **panel layout** (`meta.json` + `clientsTable.json`) and the **native Amnezia client layout** (`xray_*.key` files + `clientsTable`), so a node first installed via the official mobile/desktop app can be attached to the panel without re-installation.
+    *   **Hysteria 2**: QUIC/HTTP3 proxy from [apernet/hysteria](https://github.com/apernet/hysteria) — Let's Encrypt TLS, salamander obfuscation, password auth, `hy2://` share links.
     *   **Telemt (Telegram MTProxy)**: High-performance Telegram MTProxy with TLS emulation and comprehensive management (quotas, IP limits, real-time session tracking). Robust install path that auto-configures Docker's official apt/yum repository when needed.
     *   **Cloudflare WARP**: Add and manage WARP-powered connectivity from the panel for routing and network flexibility.
 *   **🛠 Services**:
@@ -223,6 +224,7 @@ GitHub Actions workflows in `.github/workflows/`:
 *   **Clearer create flow**: pick **server first**, then **protocol** (WireGuard, AmneziaWG 2.0, …) — invites, guest access, and user connections no longer dump everything into one messy list.
 *   Protocol titles are human-readable and ordered (AWG 2.0 → AWG → Legacy → WireGuard → Xray → Telemt).
 *   3x-ui is a separate “server” choice; VLESS inbounds still load from that panel’s API.
+*   **Hysteria 2** restored ([apernet/hysteria](https://github.com/apernet/hysteria)) via official `tobyxdd/hysteria:v2` image, Let’s Encrypt domain TLS, selectable UDP port, `hy2://` client links.
 
 ### v1.6.0
 *   **3x-ui multi-panel**: register several 3x-ui servers in Settings; pick a panel and load VLESS inbounds over its API when creating users/invites (share link comes from 3x-ui).
@@ -233,7 +235,6 @@ GitHub Actions workflows in `.github/workflows/`:
 *   **Share / guest**: one-tap “Copy key”.
 *   **User expiration**: countdown can start on first config use; UTC-safe comparisons.
 *   **UI**: shared SVG icon system.
-*   **Removed earlier**: Hysteria 2.
 
 ## 🔧 Project Details
 
@@ -295,6 +296,7 @@ web-panel/
 │   ├── awg_manager.py        # AmneziaWG / AWG 2.0 / AWG Legacy
 │   ├── wireguard_manager.py  # Classic WireGuard
 │   ├── xray_manager.py       # Xray-core (VLESS-Reality)
+│   ├── hysteria_manager.py   # Hysteria 2 (apernet/hysteria)
 │   ├── telemt_manager.py     # Telegram MTProxy
 │   ├── dns_manager.py        # AmneziaDNS (Unbound)
 │   ├── adguard_manager.py    # AdGuard Home

app.py

@@ -843,8 +843,8 @@ async def wait_for_tunnel_url(provider: str, seconds: int = 20):
     return get_tunnel_status(provider)
 
 
-BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
+BASE_PROTOCOLS = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'dns', 'wireguard', 'socks5', 'adguard', 'nginx']
-MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'socks5'}
+MULTI_INSTANCE_PROTOCOLS = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'}
 
 
 def protocol_base(protocol: str) -> str:
@@ -884,6 +884,7 @@ def protocol_display_name(protocol: str) -> str:
         'awg_legacy': 'AmneziaWG Legacy',
         'xray': 'Xray',
         'telemt': 'Telemt',
+        'hysteria': 'Hysteria 2',
         'dns': 'AmneziaDNS',
         'wireguard': 'WireGuard',
         'socks5': 'SOCKS5',
@@ -903,6 +904,7 @@ def protocol_container_name(protocol: str) -> Optional[str]:
         'awg_legacy': 'amnezia-awg-legacy',
         'xray': 'amnezia-xray',
         'telemt': 'telemt',
+        'hysteria': 'amnezia-hysteria',
         'dns': 'amnezia-dns',
         'wireguard': 'amnezia-wireguard',
         'socks5': 'amnezia-socks5proxy',
@@ -942,6 +944,9 @@ def get_protocol_manager(ssh, protocol: str):
     elif base == 'nginx':
         from managers.nginx_manager import NginxManager
         return NginxManager(ssh, protocol)
+    elif base == 'hysteria':
+        from managers.hysteria_manager import HysteriaManager
+        return HysteriaManager(ssh, protocol)
     from managers.awg_manager import AWGManager
     return AWGManager(ssh)
 
@@ -1003,7 +1008,7 @@ def _manager_call(manager, method, protocol, *args, **kwargs):
 
 
 # Protocols that own VPN clients (can list/link connections)
-CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'xui'}
+CLIENT_VPN_BASES = {'awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard', 'hysteria', 'xui'}
 
 
 def generate_vpn_link(config_text):
@@ -1665,6 +1670,8 @@ class AddServerRequest(BaseModel):
     password: str = ''
     private_key: str = ''
     name: str = ''
+    ssl_domain: str = ''
+    ssl_email: str = ''
 
 
 class EditServerRequest(BaseModel):
@@ -1677,6 +1684,8 @@ class EditServerRequest(BaseModel):
     # fields can be omitted to keep current auth unchanged.
     password: Optional[str] = None
     private_key: Optional[str] = None
+    ssl_domain: Optional[str] = None
+    ssl_email: Optional[str] = None
 
 
 class ReorderServersRequest(BaseModel):
@@ -1706,6 +1715,9 @@ class InstallProtocolRequest(BaseModel):
     # NGINX
     nginx_domain: Optional[str] = None
     nginx_email: Optional[str] = None
+    # Hysteria
+    hysteria_domain: Optional[str] = None
+    hysteria_email: Optional[str] = None
 
 
 class Socks5SettingsRequest(BaseModel):
@@ -1715,6 +1727,14 @@ class Socks5SettingsRequest(BaseModel):
     password: Optional[str] = None
 
 
+class HysteriaSettingsRequest(BaseModel):
+    protocol: str = 'hysteria'
+    port: Optional[int] = None
+    domain: Optional[str] = None
+    email: Optional[str] = None
+    renew_ssl: bool = False
+
+
 class ProtocolRequest(BaseModel):
     protocol: str = 'awg'
 
@@ -2433,6 +2453,13 @@ async def api_add_server(request: Request, req: AddServerRequest):
             'private_key': req.private_key, 'server_info': server_info,
             'protocols': {},
         }
+        ssl_domain = (req.ssl_domain or '').strip().lower()
+        ssl_email = (req.ssl_email or '').strip()
+        if ssl_domain:
+            server_info['ssl_domain'] = ssl_domain
+        if ssl_email:
+            server_info['ssl_email'] = ssl_email
+        server['server_info'] = server_info
         data = load_data()
         data['servers'].append(server)
         save_data(data)
@@ -2493,9 +2520,27 @@ async def api_edit_server(request: Request, server_id: int, req: EditServerReque
         server['username'] = new_user
         server['password'] = new_pass
         server['private_key'] = new_key
-        server['server_info'] = server_info
+        # Merge SSH probe info with preserved SSL domain defaults
+        info = dict(server.get('server_info') or {})
+        if isinstance(server_info, dict):
+            for k, v in server_info.items():
+                if k not in ('ssl_domain', 'ssl_email'):
+                    info[k] = v
+        if req.ssl_domain is not None:
+            domain = (req.ssl_domain or '').strip().lower()
+            if domain:
+                info['ssl_domain'] = domain
+            else:
+                info.pop('ssl_domain', None)
+        if req.ssl_email is not None:
+            email = (req.ssl_email or '').strip()
+            if email:
+                info['ssl_email'] = email
+            else:
+                info.pop('ssl_email', None)
+        server['server_info'] = info
         save_data(data)
-        return {'status': 'success', 'server_info': server_info}
+        return {'status': 'success', 'server_info': info}
     except Exception as e:
         logger.exception("Error editing server")
         return JSONResponse({'error': str(e)}, status_code=500)
@@ -2801,6 +2846,12 @@ async def api_check_server(request: Request, server_id: int):
                         for key in ('domain', 'email', 'site_url'):
                             if db_proto.get(key) not in (None, ''):
                                 merged[key] = db_proto[key]
+                    if protocol_base(proto) == 'hysteria':
+                        for key in ('domain', 'email'):
+                            if db_proto.get(key) not in (None, '') and not merged.get(key):
+                                merged[key] = db_proto[key]
+                        if db_proto.get('port') and not merged.get('port'):
+                            merged['port'] = db_proto['port']
                     return merged
 
                 def should_preserve_saved_protocol(proto, result=None, err=None):
@@ -2952,6 +3003,13 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
                 domain=req.nginx_domain,
                 email=req.nginx_email,
             )
+        elif install_base == 'hysteria':
+            result = manager.install_protocol(
+                protocol_type=install_protocol,
+                port=req.port,
+                domain=req.hysteria_domain,
+                email=req.hysteria_email,
+            )
         else:
             result = manager.install_protocol(install_protocol, port=req.port)
 
@@ -2978,6 +3036,18 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
             proto_record['domain'] = result.get('domain')
             proto_record['email'] = result.get('email')
             proto_record['site_url'] = result.get('site_url')
+        if install_base == 'hysteria':
+            # Remember domain/email as server defaults for next installs / renewals
+            info = server.setdefault('server_info', {})
+            if req.hysteria_domain:
+                info['ssl_domain'] = (req.hysteria_domain or '').strip().lower()
+            if req.hysteria_email:
+                info['ssl_email'] = (req.hysteria_email or '').strip()
+            save_data(data)
+            proto_record['domain'] = result.get('domain')
+            proto_record['email'] = result.get('email')
+            if result.get('port'):
+                proto_record['port'] = str(result['port'])
         proto_record['base_protocol'] = install_base
         proto_record['instance'] = protocol_instance(install_protocol)
         proto_record['display_name'] = protocol_display_name(install_protocol)
@@ -3053,6 +3123,82 @@ async def api_socks5_update_credentials(request: Request, server_id: int, req: S
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+@app.get('/api/servers/{server_id}/hysteria/settings', tags=["Protocols"])
+async def api_hysteria_get_settings(request: Request, server_id: int, protocol: str = 'hysteria'):
+    """Return current Hysteria domain/port for the settings modal."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        data = load_data()
+        if server_id >= len(data['servers']):
+            return JSONResponse({'error': 'Server not found'}, status_code=404)
+        if not is_valid_protocol(protocol) or protocol_base(protocol) != 'hysteria':
+            return JSONResponse({'error': 'Invalid protocol'}, status_code=400)
+        server = data['servers'][server_id]
+        ssh = get_ssh(server)
+        ssh.connect()
+        manager = get_protocol_manager(ssh, protocol)
+        settings = manager.get_settings()
+        ssh.disconnect()
+        saved = (server.get('protocols') or {}).get(protocol) or {}
+        if not settings.get('port') and saved.get('port'):
+            settings['port'] = int(saved['port'])
+        return {'status': 'success', **settings}
+    except Exception as e:
+        logger.exception("Error reading Hysteria settings")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
+@app.post('/api/servers/{server_id}/hysteria/settings', tags=["Protocols"])
+async def api_hysteria_update_settings(request: Request, server_id: int, req: HysteriaSettingsRequest):
+    """Change Hysteria UDP listen port and recreate the container."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        data = load_data()
+        if server_id >= len(data['servers']):
+            return JSONResponse({'error': 'Server not found'}, status_code=404)
+        protocol = req.protocol if is_valid_protocol(req.protocol) and protocol_base(req.protocol) == 'hysteria' else 'hysteria'
+        server = data['servers'][server_id]
+        ssh = get_ssh(server)
+        ssh.connect()
+        manager = get_protocol_manager(ssh, protocol)
+        result = manager.update_settings(
+            port=req.port,
+            domain=req.domain,
+            email=req.email,
+            renew_ssl=bool(req.renew_ssl),
+        )
+        ssh.disconnect()
+        if result.get('status') == 'error':
+            return JSONResponse(
+                {'error': result.get('message') or 'Failed to update settings', **{k: v for k, v in result.items() if k != 'status'}},
+                status_code=400,
+            )
+        if result.get('port') or result.get('domain'):
+            srv_proto = server.setdefault('protocols', {}).setdefault(protocol, {})
+            if result.get('port'):
+                srv_proto['port'] = str(result['port'])
+            srv_proto['installed'] = True
+            srv_proto['base_protocol'] = protocol_base(protocol)
+            srv_proto['instance'] = protocol_instance(protocol)
+            srv_proto['display_name'] = protocol_display_name(protocol)
+            srv_proto['container_name'] = protocol_container_name(protocol)
+            if result.get('domain'):
+                srv_proto['domain'] = result['domain']
+            # Keep server-level SSL defaults in sync
+            info = server.setdefault('server_info', {})
+            if result.get('domain'):
+                info['ssl_domain'] = result['domain']
+            if result.get('email'):
+                info['ssl_email'] = result['email']
+            save_data(data)
+        return result
+    except Exception as e:
+        logger.exception("Error updating Hysteria settings")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
 @app.post('/api/servers/{server_id}/uninstall', tags=["Protocols"])
 async def api_uninstall_protocol(request: Request, server_id: int, req: ProtocolRequest):
     if not _check_admin(request):
@@ -3086,6 +3232,7 @@ CONTAINER_NAMES = {
     'awg_legacy': 'amnezia-awg-legacy',
     'xray': 'amnezia-xray',
     'telemt': 'telemt',
+    'hysteria': 'amnezia-hysteria',
     'dns': 'amnezia-dns',
     'wireguard': 'amnezia-wireguard',
     'socks5': 'amnezia-socks5proxy',
@@ -3391,14 +3538,40 @@ async def api_container_toggle(request: Request, server_id: int, req: ProtocolRe
         if is_running:
             ssh.run_sudo_command(f"docker stop {container}")
             action = 'stopped'
+        else:
+            if protocol_base(req.protocol) == 'hysteria':
+                from managers.hysteria_manager import HysteriaManager
+                mgr = HysteriaManager(ssh, req.protocol)
+                meta = mgr._read_metadata()
+                port = int(meta.get('port') or mgr.DEFAULT_PORT)
+                mgr._write_config_from_clients(port)
+                mgr._start_container(port)
             else:
                 ssh.run_sudo_command(f"docker start {container}")
             action = 'started'
+        error = ''
+        recent_logs = ''
+        if protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            diag = mgr.get_container_diagnostics(req.protocol)
+            error = diag.get('error_summary') or ''
+            recent_logs = diag.get('recent_logs') or ''
+            if action == 'started' and not diag.get('running'):
+                ssh.disconnect()
+                return JSONResponse({
+                    'error': error or 'Hysteria failed to start',
+                    'action': action,
+                    'container': container,
+                    'recent_logs': recent_logs,
+                }, status_code=400)
         ssh.disconnect()
         return {
             'status': 'success',
             'action': action,
             'container': container,
+            'error': error,
+            'recent_logs': recent_logs,
         }
     except Exception as e:
         logger.exception("Error toggling container")
@@ -3420,7 +3593,22 @@ async def api_container_logs(request: Request, server_id: int, req: ContainerLog
         container = protocol_container_name(req.protocol)
         ssh = get_ssh(server)
         ssh.connect()
-        # Generic docker logs for all protocols
+        if protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            logs = mgr.get_logs(req.protocol, tail=req.tail or 200)
+            diag = mgr.get_container_diagnostics(req.protocol)
+            ssh.disconnect()
+            return {
+                'status': 'success',
+                'protocol': req.protocol,
+                'container': container,
+                'logs': logs,
+                'running': bool(diag.get('running')),
+                'error': diag.get('error_summary') or '',
+                'exit_code': diag.get('exit_code'),
+                'container_status': diag.get('status') or '',
+            }
         tail = max(20, min(int(req.tail or 200), 2000))
         out, err, _ = ssh.run_sudo_command(
             f"docker logs --tail {tail} --timestamps {shlex.quote(container)} 2>&1",
@@ -3541,6 +3729,10 @@ async def api_server_config(request: Request, server_id: int, req: ProtocolReque
             from managers.nginx_manager import NginxManager
             mgr = NginxManager(ssh, req.protocol)
             config = mgr._get_server_config(req.protocol)
+        elif protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            config = mgr.get_server_config(req.protocol)
         else:
             mgr = AWGManager(ssh)
             config = mgr._get_server_config(req.protocol)
@@ -3585,6 +3777,10 @@ async def api_server_config_save(request: Request, server_id: int, req: ServerCo
             from managers.nginx_manager import NginxManager
             mgr = NginxManager(ssh, req.protocol)
             mgr.save_server_config(req.protocol, req.config)
+        elif protocol_base(req.protocol) == 'hysteria':
+            from managers.hysteria_manager import HysteriaManager
+            mgr = HysteriaManager(ssh, req.protocol)
+            mgr.save_server_config(req.protocol, req.config)
         else:
             mgr = AWGManager(ssh)
             mgr.save_server_config(req.protocol, req.config)

managers/backup_manager.py

@@ -62,6 +62,10 @@ class BackupManager:
             remote_dir = inst_path('/opt/amnezia/telemt')
             paths['host'] = [remote_dir]
             paths['container'] = [remote_dir]
+        elif base == 'hysteria':
+            remote_dir = inst_path('/opt/amnezia/hysteria')
+            paths['host'] = [remote_dir]
+            paths['container'] = ['/etc/hysteria']
         elif base == 'dns':
             paths['host'] = ['/opt/amnezia/dns']
             paths['container'] = ['/opt/amnezia/dns']

managers/hysteria_manager.py

@@ -1,5 +1,5 @@
-"""
+"""
-Hysteria 2 protocol manager — teddysun/hysteria Docker image.
+Hysteria 2 protocol manager — official tobyxdd/hysteria image (apernet/hysteria).
 
 Installs Hysteria with Let's Encrypt TLS for an admin-provided domain
 (certbot standalone on port 80), host networking, BBR, and salamander obfs.
@@ -32,7 +32,7 @@ def _rand_token(length=16):
 class HysteriaManager:
     PROTOCOL = 'hysteria'
     CONTAINER_NAME = 'amnezia-hysteria'
-    IMAGE_NAME = 'teddysun/hysteria:latest'
+    IMAGE_NAME = 'tobyxdd/hysteria:v2'
     CERTBOT_IMAGE = 'certbot/certbot:latest'
     BASE_DIR = '/opt/amnezia/hysteria'
     DEFAULT_PORT = 8998
@@ -449,7 +449,8 @@ iptables -C INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || iptables -I INP
             f"--network host "
             f"--cap-add=NET_ADMIN "
             f"-v {_q(self.base_dir)}:/etc/hysteria "
-            f"{self.IMAGE_NAME}"
+            f"{self.IMAGE_NAME} "
+            f"-c /etc/hysteria/server.yaml server"
         )
         _, err, code = self.ssh.run_sudo_command(run_cmd, timeout=60)
         if code != 0:
@@ -475,8 +476,8 @@ iptables -C INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || iptables -I INP
             'protocol': self.protocol,
         }
 
-    def update_settings(self, port=None):
+    def update_settings(self, port=None, domain=None, email=None, renew_ssl=False):
-        """Change listen UDP port and recreate the container."""
+        """Change listen UDP port and/or re-issue Let's Encrypt for domain."""
         meta = self._ensure_secrets(self._read_metadata())
         if port is None:
             port = meta.get('port') or self.DEFAULT_PORT
@@ -486,6 +487,32 @@ iptables -C INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || iptables -I INP
         if port == 80:
             return {'status': 'error', 'message': 'Port 80 is reserved for Let\'s Encrypt validation'}
 
+        old_domain = (meta.get('domain') or '').strip().lower()
+        domain_changed = False
+        try:
+            if domain is not None and str(domain).strip():
+                new_domain = self._validate_domain(domain)
+                domain_changed = new_domain != old_domain
+                meta['domain'] = new_domain
+            if email is not None and str(email).strip():
+                meta['email'] = self._validate_email(email)
+        except ValueError as e:
+            return {'status': 'error', 'message': str(e)}
+
+        if renew_ssl or domain_changed:
+            # Domain change or explicit renew → re-issue certificate (needs free TCP 80)
+            try:
+                d = meta.get('domain') or ''
+                e = meta.get('email') or ''
+                if not d or not e:
+                    return {
+                        'status': 'error',
+                        'message': 'Domain and email are required to issue SSL',
+                    }
+                self._issue_certificate(d, e)
+            except Exception as exc:
+                return {'status': 'error', 'message': str(exc)}
+
         meta['port'] = port
         self._write_metadata(meta)
         self._write_config_from_clients(port)
@@ -497,13 +524,17 @@ iptables -C INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || iptables -I INP
                 'message': str(e),
                 'port': str(port),
                 'domain': meta.get('domain'),
+                'email': meta.get('email'),
             }
+        msg = 'Hysteria settings updated'
+        if renew_ssl or domain_changed:
+            msg = 'SSL certificate issued and Hysteria settings updated'
         return {
             'status': 'success',
             'port': str(port),
             'domain': meta.get('domain'),
             'email': meta.get('email'),
-            'message': f'Hysteria listening on UDP {port}',
+            'message': msg,
         }
 
     def _reload_container(self):
@@ -539,7 +570,7 @@ iptables -C INPUT -p udp --dport {port} -j ACCEPT 2>/dev/null || iptables -I INP
                 f"Point A-record to this server and free TCP port 80. {err or out}"
             )
 
-        # Copy live certs into paths expected by teddysun image
+        # Copy live certs into paths expected by the server config
         copy_script = f"""
 set -e
 LIVE={_q(self.letsencrypt_dir)}/live/{_q(domain)}

static/css/style.css

@@ -944,6 +944,11 @@ a:hover {
     color: #38bdf8;
 }
 
+.protocol-hysteria .protocol-icon {
+    background: linear-gradient(135deg, rgba(14, 165, 233, 0.2), rgba(99, 102, 241, 0.1));
+    color: #38bdf8;
+}
+
 .protocol-dns .protocol-icon {
     background: linear-gradient(135deg, rgba(34, 197, 94, 0.2), rgba(16, 185, 129, 0.1));
     color: var(--success);

telegram_bot.py

@@ -24,7 +24,7 @@ _bot_task: Optional[asyncio.Task] = None
 _callback_refs = {}
 _pending_inputs = {}
 
-CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "wireguard"}
+CLIENT_PROTOCOLS = {"awg", "awg2", "awg_legacy", "xray", "telemt", "hysteria", "wireguard"}
 SERVICE_PROTOCOLS = {"dns", "adguard", "socks5", "nginx"}
 
 
@@ -137,6 +137,7 @@ def _protocol_display_name(protocol: str) -> str:
         "awg_legacy": "AmneziaWG Legacy",
         "xray": "Xray",
         "telemt": "Telemt",
+        "hysteria": "Hysteria 2",
         "dns": "AmneziaDNS",
         "wireguard": "WireGuard",
         "socks5": "SOCKS5",
@@ -561,7 +562,7 @@ async def _send_config_by_client(api: TelegramAPI, chat_id: int, server: dict, p
         server_name = server.get("name") or server.get("host", "Unknown")
         await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server_name)}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
 
-        is_link_proto = _proto_base(proto) in ("xray", "telemt")
+        is_link_proto = _proto_base(proto) in ("xray", "telemt", "hysteria")
         if is_link_proto:
             await api.send_message(chat_id, f"🔗 <b>Connection link</b> (tap to copy):\n<code>{_e(config)}</code>")
         else:
@@ -918,7 +919,7 @@ async def _admin_create_client(api: TelegramAPI, chat_id: int, message_id: int,
 
 async def _send_config_text(api: TelegramAPI, chat_id: int, server: dict, proto: str, conn_name: str, config: str, generate_vpn_link_fn: Callable):
     await api.send_message(chat_id, f"✅ <b>{_e(conn_name)}</b>\n🌐 Server: <b>{_e(server.get('name') or server.get('host'))}</b>\n🔌 Protocol: <b>{_e(proto.upper())}</b>")
-    if _proto_base(proto) in ("xray", "telemt"):
+    if _proto_base(proto) in ("xray", "telemt", "hysteria"):
         await api.send_message(chat_id, f"🔗 <b>Connection link</b>:\n<code>{_e(config)}</code>")
     else:
         await api.send_message(chat_id, f"<b>📄 Configuration:</b>\n<pre>{_e(config)}</pre>")

templates/index.html

@@ -19,6 +19,8 @@
         <div class="card card-hover server-card" id="server-{{ loop.index0 }}" data-idx="{{ loop.index0 }}"
             data-name="{{ server.name }}" data-host="{{ server.host }}" data-port="{{ server.ssh_port }}"
             data-username="{{ server.username }}" data-auth="{{ 'key' if server.private_key else 'password' }}"
+            data-ssl-domain="{{ (server.server_info or {}).get('ssl_domain', '') }}"
+            data-ssl-email="{{ (server.server_info or {}).get('ssl_email', '') }}"
             draggable="true">
             <div class="server-meta">
                 <div class="server-icon">{{ icon('server') }}</div>
@@ -137,6 +139,16 @@
                 </div>
             </div>
 
+            <div class="form-group" style="margin-top: var(--space-md)">
+                <label class="form-label">{{ _('server_ssl_domain') }}</label>
+                <input class="form-input" type="text" id="editServerSslDomain" placeholder="vpn.example.com">
+                <div class="form-hint">{{ _('server_ssl_hint') }}</div>
+            </div>
+            <div class="form-group">
+                <label class="form-label">{{ _('server_ssl_email') }}</label>
+                <input class="form-input" type="email" id="editServerSslEmail" placeholder="admin@example.com">
+            </div>
+
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" onclick="closeModal('editServerModal')">{{ _('cancel')
                     }}</button>
@@ -202,6 +214,16 @@
                 </div>
             </div>
 
+            <div class="form-group" style="margin-top: var(--space-md)">
+                <label class="form-label">{{ _('server_ssl_domain') }}</label>
+                <input class="form-input" type="text" id="serverSslDomain" placeholder="vpn.example.com">
+                <div class="form-hint">{{ _('server_ssl_hint') }}</div>
+            </div>
+            <div class="form-group">
+                <label class="form-label">{{ _('server_ssl_email') }}</label>
+                <input class="form-input" type="email" id="serverSslEmail" placeholder="admin@example.com">
+            </div>
+
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" onclick="closeModal('addServerModal')">{{ _('cancel')
                     }}</button>
@@ -244,6 +266,8 @@
                 username: document.getElementById('serverUser').value,
                 password: document.getElementById('serverPassword').value,
                 private_key: document.getElementById('serverKey').value,
+                ssl_domain: document.getElementById('serverSslDomain').value.trim(),
+                ssl_email: document.getElementById('serverSslEmail').value.trim(),
             };
 
             const result = await apiCall('/api/servers/add', 'POST', data);
@@ -292,6 +316,8 @@
         document.getElementById('editServerUser').value = card.dataset.username || '';
         document.getElementById('editServerPassword').value = '';
         document.getElementById('editServerKey').value = '';
+        document.getElementById('editServerSslDomain').value = card.dataset.sslDomain || '';
+        document.getElementById('editServerSslEmail').value = card.dataset.sslEmail || '';
 
         // Pre-select the tab matching the server's current auth method.
         const authIsKey = card.dataset.auth === 'key';
@@ -321,6 +347,8 @@
                 // Empty -> null means "leave unchanged" on the backend.
                 password: document.getElementById('editServerPassword').value || null,
                 private_key: document.getElementById('editServerKey').value || null,
+                ssl_domain: document.getElementById('editServerSslDomain').value.trim(),
+                ssl_email: document.getElementById('editServerSslEmail').value.trim(),
             };
             await apiCall(`/api/servers/${idx}/edit`, 'POST', body);
             showToast(_('server_saved'), 'success');

templates/invites.html

@@ -196,7 +196,7 @@
     const xuiConfigured = {{ 'true' if xui_configured else 'false' }};
     const xuiDefaultInbound = {{ xui_default_inbound | int }};
     const xuiDefaultPanelId = {{ (xui_default_panel_id or '') | tojson }};
-    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt'];
+    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria'];
     const PROTO_TITLES = {
         awg2: 'AmneziaWG 2.0',
         awg: 'AmneziaWG',
@@ -204,6 +204,7 @@
         wireguard: 'WireGuard',
         xray: 'Xray (VLESS-Reality)',
         telemt: 'Telemt',
+        hysteria: 'Hysteria 2',
         xui: '3x-ui VLESS',
     };
 

templates/my_connections.html

@@ -118,10 +118,10 @@
                 document.getElementById('configText').textContent = result.config;
                 document.getElementById('vpnLinkText').textContent = currentVpnLink;
 
-                // Telemt uses share links, not vpn:// Amnezia format
+                // Telemt / Hysteria use share links, not vpn:// Amnezia format
                 const vpnTab = document.querySelectorAll('.config-tab')[1];
                 const vpnPanel = document.getElementById('panel-vpn');
-                if (proto === 'telemt') {
+                if (proto === 'telemt' || String(proto || '').split('__')[0] === 'hysteria') {
                     vpnTab.style.display = 'none';
                 } else {
                     vpnTab.style.display = '';

templates/server.html

@@ -295,6 +295,30 @@
         </div>
     </div>
 
+    <!-- Hysteria Card -->
+    <div class="card card-hover protocol-card protocol-hysteria" id="proto-hysteria">
+        <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
+            <div class="protocol-icon">{{ icon('refresh') }}</div>
+            <div class="flex gap-sm" id="hysteria-ctrl" style="display:none!important;"></div>
+        </div>
+        <div class="protocol-name">Hysteria 2</div>
+        <div class="protocol-desc">
+            {{ _('hysteria_desc') }}
+        </div>
+        <div class="protocol-status" id="hysteria-status">
+            <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
+        </div>
+        <div id="hysteria-info" class="hidden">
+            <div class="protocol-info" id="hysteria-info-grid"></div>
+        </div>
+        <div class="flex gap-sm" id="hysteria-actions">
+            <button class="btn btn-primary btn-sm" onclick="openInstallModal('hysteria')" id="hysteria-install-btn"
+                style="flex:1">
+                {{ _('install') }}
+            </button>
+        </div>
+    </div>
+
     <!-- WireGuard Card -->
     <div class="card card-hover protocol-card protocol-wireguard" id="proto-wireguard">
         <div style="display:flex; align-items:center; justify-content:space-between; margin-bottom:var(--space-sm);">
@@ -657,6 +681,28 @@
                 <div class="form-hint">{{ _('nginx_install_hint') }}</div>
             </div>
 
+            <div id="hysteriaOptions"
+                style="display:none; padding: var(--space-md); background: rgba(0,0,0,0.03); border-radius: var(--radius-md); margin-bottom: var(--space-md);">
+                <div class="form-hint" style="margin-bottom: var(--space-md); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35); color: var(--text);">
+                    {{ _('hysteria_ports_warning') }}
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('port') }} (UDP) *</label>
+                    <input class="form-input" type="number" id="installHysteriaPort" value="8998" min="1" max="65535">
+                    <div class="form-hint">{{ _('hysteria_port_hint') }}</div>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('hysteria_domain') }}</label>
+                    <input class="form-input" type="text" id="installHysteriaDomain" placeholder="vpn.example.com" oninput="updateHysteriaDnsHint()">
+                    <div class="form-hint" id="hysteriaDnsHint"></div>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">{{ _('hysteria_email') }}</label>
+                    <input class="form-input" type="email" id="installHysteriaEmail" placeholder="admin@example.com">
+                </div>
+                <div class="form-hint">{{ _('hysteria_install_hint') }}</div>
+            </div>
+
             <div class="modal-footer">
                 <button class="btn btn-secondary" onclick="closeModal('installModal')">{{ _('cancel') }}</button>
                 <button class="btn btn-primary" onclick="installProtocol()" id="installBtn">
@@ -711,6 +757,45 @@
     </div>
 </div>
 
+<!-- ===== Hysteria Settings Modal ===== -->
+<div class="modal-backdrop" id="hysteriaSettingsModal">
+    <div class="modal">
+        <div class="modal-header">
+            <h2 class="modal-title" id="hysteriaSettingsTitle">{{ _('hysteria_settings_title') }}</h2>
+            <button class="modal-close" onclick="closeModal('hysteriaSettingsModal')">×</button>
+        </div>
+        <input type="hidden" id="hysteriaSetProto" value="hysteria" />
+        <div class="form-hint" style="margin-bottom: var(--space-md); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">
+            {{ _('hysteria_ports_warning') }}
+        </div>
+        <div class="form-group">
+            <label class="form-label">{{ _('hysteria_domain') }}</label>
+            <input class="form-input" type="text" id="hysteriaSetDomain" placeholder="vpn.example.com">
+            <div class="form-hint">{{ _('hysteria_ssl_change_hint') }}</div>
+        </div>
+        <div class="form-group">
+            <label class="form-label">{{ _('hysteria_email') }}</label>
+            <input class="form-input" type="email" id="hysteriaSetEmail" placeholder="admin@example.com">
+        </div>
+        <div class="form-group">
+            <label class="form-label">{{ _('port') }} (UDP)</label>
+            <input class="form-input" type="number" id="hysteriaSetPort" min="1" max="65535" value="8998">
+            <div class="form-hint">{{ _('hysteria_port_change_hint') }}</div>
+        </div>
+        <div class="modal-footer" style="flex-wrap: wrap; gap: var(--space-sm);">
+            <button class="btn btn-secondary" onclick="closeModal('hysteriaSettingsModal')">{{ _('cancel') }}</button>
+            <button class="btn btn-secondary" onclick="renewHysteriaSsl()" id="hysteriaRenewBtn">
+                <span id="hysteriaRenewBtnText">{{ _('hysteria_renew_ssl') }}</span>
+                <div class="spinner hidden" id="hysteriaRenewSpinner"></div>
+            </button>
+            <button class="btn btn-primary" onclick="saveHysteriaSettings()" id="hysteriaSaveBtn">
+                <span id="hysteriaSaveBtnText">{{ _('save') }}</span>
+                <div class="spinner hidden" id="hysteriaSaveSpinner"></div>
+            </button>
+        </div>
+    </div>
+</div>
+
 <!-- ===== NGINX Site Modal ===== -->
 <div class="modal-backdrop" id="siteConfigModal">
     <div class="modal" style="max-width:680px;">
@@ -961,12 +1046,15 @@
 <script>
     const SERVER_ID = {{ server_id }};
     const SERVER_HOST = "{{ server.host }}";
+    const SERVER_SSL_DOMAIN = {{ ((server.server_info or {}).get('ssl_domain') or '') | tojson }};
+    const SERVER_SSL_EMAIL = {{ ((server.server_info or {}).get('ssl_email') or '') | tojson }};
     const MARKETPLACE_APPS = [
         { proto: 'awg2', category: 'protocols', icon: 'sparkles', title: 'AmneziaWG 2.0', descKey: 'awg_desc', badge: 'NEW' },
         { proto: 'awg', category: 'protocols', icon: 'shield', title: 'AmneziaWG', descKey: 'awg_desc' },
         { proto: 'awg_legacy', category: 'protocols', icon: 'radio', title: 'AmneziaWG Legacy', descKey: 'awg_legacy_desc' },
         { proto: 'xray', category: 'protocols', icon: 'zap', title: 'Xray (VLESS-Reality)', descKey: 'xray_desc' },
         { proto: 'telemt', category: 'protocols', icon: 'plane', title: 'Telemt (Telegram Proxy)', descKey: 'telemt_desc' },
+        { proto: 'hysteria', category: 'protocols', icon: 'refresh', title: 'Hysteria 2', descKey: 'hysteria_desc' },
         { proto: 'wireguard', category: 'protocols', icon: 'lock', title: 'WireGuard', descKey: 'wireguard_desc' },
         { proto: 'dns', category: 'services', icon: 'search', title: 'AmneziaDNS', descKey: 'dns_desc' },
         { proto: 'adguard', category: 'services', icon: 'shield-check', title: 'AdGuard Home', descKey: 'adguard_desc' },
@@ -1002,7 +1090,7 @@
     }
 
     function isMultiInstanceBase(proto) {
-        return ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'socks5'].includes(protoBase(proto));
+        return ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'socks5'].includes(protoBase(proto));
     }
 
     function nextSuggestedPort(base, fallback) {
@@ -1207,6 +1295,7 @@
             case 'awg_legacy': title = 'AmneziaWG Legacy'; break;
             case 'xray': title = 'Xray'; break;
             case 'telemt': title = 'Telemt'; break;
+            case 'hysteria': title = 'Hysteria 2'; break;
             case 'wireguard': title = 'WireGuard'; break;
             case 'dns': title = 'AmneziaDNS'; break;
             case 'socks5': title = 'SOCKS5 Proxy'; break;
@@ -1266,7 +1355,7 @@
 
                 for (const [proto, info] of orderedProtocolEntries(data.protocols)) {
                     updateProtocolCard(proto, info);
-                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'wireguard'].includes(protoBase(proto));
+                    const isVPN = ['awg', 'awg2', 'awg_legacy', 'xray', 'telemt', 'hysteria', 'wireguard'].includes(protoBase(proto));
                     if (info.container_running && isVPN) {
                         const opt = document.createElement('option');
                         opt.value = proto;
@@ -1495,6 +1584,9 @@
                     grid = buildServiceInfoGrid(proto, info);
                 } else if (info.port) {
                     grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('port')}</span><span class="protocol-info-value">${info.port}/${(['xray', 'telemt'].includes(protoBase(proto))) ? 'TCP' : 'UDP'}</span></div>`;
+                    if (protoBase(proto) === 'hysteria' && info.domain) {
+                        grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('hysteria_domain')}</span><span class="protocol-info-value">${info.domain}</span></div>`;
+                    }
                 }
                 if (!isService && info.clients_count !== undefined) {
                     grid += `<div class="protocol-info-item"><span class="protocol-info-label">${_('connections')}</span><span class="protocol-info-value">${info.clients_count}</span></div>`;
@@ -1529,6 +1621,14 @@
                     <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')" style="flex:1">${_('backup')}</button>
                     <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
                 `;
+            } else if (protoBase(proto) === 'hysteria') {
+                actionsEl.innerHTML = `
+                    <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="openHysteriaSettings('${proto}')">${_('hysteria_change_port')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')">${_('backup')}</button>
+                    <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
+                `;
+                showConnectionsSection();
             } else {
                 actionsEl.innerHTML = `
                     <button class="btn btn-secondary btn-sm" onclick="selectProtocolForConns('${proto}')" style="flex:1">${_('connections')}</button>
@@ -1565,6 +1665,7 @@
         } else if (info.container_exists) {
             installedProtocols[proto] = true;
             const errText = String(info.error || '').trim();
+            const portBusy = !!info.port_busy || /address already in use|UDP port \d+ already in use|already in use/i.test(errText);
             statusEl.innerHTML = errText
                 ? `<span class="badge badge-danger" style="max-width:100%; white-space:normal; text-align:left; line-height:1.35;"><span class="badge-dot"></span> ${_('stop')}: ${escapeHtml(errText.slice(0, 120))}</span>`
                 : `<span class="badge badge-danger"><span class="badge-dot"></span> ${_('stop')}</span>`;
@@ -1583,6 +1684,25 @@
                 if (errText) {
                     grid += `<div class="protocol-info-item" style="grid-column:1/-1;"><span class="protocol-info-label">${_('error')}</span><span class="protocol-info-value" style="color:var(--danger); word-break:break-word;">${escapeHtml(errText)}</span></div>`;
                 }
+                if (protoBase(proto) === 'hysteria') {
+                    const curPort = parseInt(info.port, 10) || 443;
+                    const suggest = (curPort === 443 || portBusy) ? 8998 : curPort;
+                    grid += `
+                        <div class="protocol-info-item" style="grid-column:1/-1; display:block; padding-top:8px;">
+                            <span class="protocol-info-label" style="display:block; margin-bottom:6px;">${_('hysteria_change_port')} (UDP)</span>
+                            <div style="display:flex; gap:8px; flex-wrap:wrap; align-items:center;">
+                                <input class="form-input" type="number" id="hysteriaInlinePort-${protoDomKey(proto)}"
+                                    value="${suggest}" min="1" max="65535" style="width:120px; flex:0 0 auto;">
+                                <button class="btn btn-primary btn-sm" type="button"
+                                    onclick="applyHysteriaPort('${proto}', document.getElementById('hysteriaInlinePort-${protoDomKey(proto)}').value)">
+                                    ${_('save')} &amp; ${_('start_btn')}
+                                </button>
+                                <button class="btn btn-secondary btn-sm" type="button" onclick="openHysteriaSettings('${proto}')">${_('hysteria_settings_title')}</button>
+                            </div>
+                            <div class="form-hint" style="margin-top:6px;">${_('hysteria_port_change_hint')}</div>
+                        </div>
+                    `;
+                }
                 infoGrid.innerHTML = grid;
             }
             if (isService) {
@@ -1592,6 +1712,13 @@
                     <button class="btn btn-secondary btn-sm" onclick="showProtocolBackups('${proto}')">${_('backup')}</button>
                     <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
                 `;
+            } else if (protoBase(proto) === 'hysteria') {
+                actionsEl.innerHTML = `
+                    <button class="btn btn-primary btn-sm" onclick="openHysteriaSettings('${proto}')" style="flex:1">${_('hysteria_change_port')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="showContainerLogs('${proto}')">${_('logs_btn')}</button>
+                    <button class="btn btn-secondary btn-sm" onclick="openInstallModal('${proto}')">${_('reinstall')}</button>
+                    <button class="btn btn-danger btn-sm" onclick="uninstallProtocol('${proto}')">${_('uninstall')}</button>
+                `;
             } else {
                 actionsEl.innerHTML = `
                     <button class="btn btn-primary btn-sm" onclick="openInstallModal('${proto}')" style="flex:1">${_('reinstall')}</button>
@@ -1872,6 +1999,14 @@
         hint.innerHTML = `${_('nginx_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
     }
 
+    function updateHysteriaDnsHint() {
+        const input = document.getElementById('installHysteriaDomain');
+        const hint = document.getElementById('hysteriaDnsHint');
+        if (!input || !hint) return;
+        const domain = (input.value || '').trim() || 'vpn.example.com';
+        hint.innerHTML = `${_('hysteria_dns_hint')} <code>A&nbsp;&nbsp;${domain}&nbsp;&nbsp;${SERVER_HOST}</code>`;
+    }
+
     function openInstallModal(proto, installAnother = false) {
         const base = protoBase(proto);
         currentInstallProto = installAnother ? base : proto;
@@ -1887,11 +2022,13 @@
         const socks5Opts = document.getElementById('socks5Options');
         const adguardOpts = document.getElementById('adguardOptions');
         const nginxOpts = document.getElementById('nginxOptions');
+        const hysteriaOpts = document.getElementById('hysteriaOptions');
 
         telemtOpts.style.display = 'none';
         socks5Opts.style.display = 'none';
         adguardOpts.style.display = 'none';
         nginxOpts.style.display = 'none';
+        hysteriaOpts.style.display = 'none';
         if (portGroup) portGroup.style.display = '';
 
         if (base === 'dns') {
@@ -1928,7 +2065,27 @@
             portInput.disabled = false;
             portHint.textContent = _('nginx_port_hint');
             nginxOpts.style.display = 'block';
+            const nxDomain = document.getElementById('installNginxDomain');
+            const nxEmail = document.getElementById('installNginxEmail');
+            if (nxDomain && !nxDomain.value && SERVER_SSL_DOMAIN) nxDomain.value = SERVER_SSL_DOMAIN;
+            if (nxEmail && !nxEmail.value && SERVER_SSL_EMAIL) nxEmail.value = SERVER_SSL_EMAIL;
             updateNginxDnsHint();
+        } else if (base === 'hysteria') {
+            if (portGroup) portGroup.style.display = 'none';
+            const suggested = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 8998) : '8998';
+            portInput.value = suggested;
+            portInput.disabled = false;
+            hysteriaOpts.style.display = 'block';
+            const hyPort = document.getElementById('installHysteriaPort');
+            if (hyPort) {
+                hyPort.value = suggested;
+                hyPort.oninput = () => { portInput.value = hyPort.value; };
+            }
+            const hyDomain = document.getElementById('installHysteriaDomain');
+            const hyEmail = document.getElementById('installHysteriaEmail');
+            if (hyDomain && !hyDomain.value && SERVER_SSL_DOMAIN) hyDomain.value = SERVER_SSL_DOMAIN;
+            if (hyEmail && !hyEmail.value && SERVER_SSL_EMAIL) hyEmail.value = SERVER_SSL_EMAIL;
+            updateHysteriaDnsHint();
         } else {
             portLabel.textContent = _('port') + ' (UDP)';
             portInput.value = currentInstallAnother ? nextSuggestedPort(currentInstallProto, 55424) : '55424';
@@ -1995,6 +2152,13 @@
             } else if (protoBase(currentInstallProto) === 'nginx') {
                 params.nginx_domain = document.getElementById('installNginxDomain').value.trim();
                 params.nginx_email = document.getElementById('installNginxEmail').value.trim();
+            } else if (protoBase(currentInstallProto) === 'hysteria') {
+                const hyPortEl = document.getElementById('installHysteriaPort');
+                if (hyPortEl && hyPortEl.value) {
+                    params.port = hyPortEl.value;
+                }
+                params.hysteria_domain = document.getElementById('installHysteriaDomain').value.trim();
+                params.hysteria_email = document.getElementById('installHysteriaEmail').value.trim();
             }
             const result = await apiCall(`/api/servers/${SERVER_ID}/install`, 'POST', params);
             clearInterval(progressInterval);
@@ -2210,6 +2374,107 @@
         }
     }
 
+    // ========== Hysteria Settings (port) ==========
+    async function applyHysteriaPort(proto, portValue) {
+        const port = parseInt(portValue, 10);
+        if (!port || port < 1 || port > 65535) {
+            showToast(_('error') + ': invalid port', 'error');
+            return;
+        }
+        if (port === 80) {
+            showToast(_('error') + ': port 80 reserved', 'error');
+            return;
+        }
+        try {
+            showToast(_('saving') || 'Saving...', 'info');
+            const res = await apiCall(`/api/servers/${SERVER_ID}/hysteria/settings`, 'POST', {
+                protocol: proto || 'hysteria', port,
+            });
+            showToast(res.message || _('hysteria_settings_saved'), 'success');
+            setTimeout(() => checkServer(), 800);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+            openHysteriaSettings(proto);
+        }
+    }
+
+    async function openHysteriaSettings(proto = 'hysteria') {
+        const live = currentProtocolStatus[proto] || {};
+        const livePort = live.port || 443;
+        const suggest = (parseInt(livePort, 10) === 443) ? 8998 : (livePort || 8998);
+        document.getElementById('hysteriaSetProto').value = proto;
+        document.getElementById('hysteriaSettingsTitle').textContent =
+            `${_('hysteria_settings_title')} — ${getProtoTitle(proto)}`;
+        document.getElementById('hysteriaSetDomain').value = live.domain || SERVER_SSL_DOMAIN || '';
+        document.getElementById('hysteriaSetEmail').value = live.email || SERVER_SSL_EMAIL || '';
+        document.getElementById('hysteriaSetPort').value = suggest;
+        openModal('hysteriaSettingsModal');
+        try {
+            const data = await apiCall(`/api/servers/${SERVER_ID}/hysteria/settings?protocol=${encodeURIComponent(proto)}`);
+            if (data.domain) document.getElementById('hysteriaSetDomain').value = data.domain;
+            if (data.email) document.getElementById('hysteriaSetEmail').value = data.email;
+            const p = parseInt(data.port, 10);
+            if (p && p !== 443) document.getElementById('hysteriaSetPort').value = p;
+            else if (p === 443) document.getElementById('hysteriaSetPort').value = 8998;
+        } catch (_) { /* modal already open with local values */ }
+    }
+
+    async function saveHysteriaSettings(opts = {}) {
+        const btn = document.getElementById('hysteriaSaveBtn');
+        const text = document.getElementById('hysteriaSaveBtnText');
+        const spinner = document.getElementById('hysteriaSaveSpinner');
+        const renewBtn = document.getElementById('hysteriaRenewBtn');
+        const renewText = document.getElementById('hysteriaRenewBtnText');
+        const renewSpinner = document.getElementById('hysteriaRenewSpinner');
+        const proto = document.getElementById('hysteriaSetProto').value || 'hysteria';
+        const port = parseInt(document.getElementById('hysteriaSetPort').value, 10);
+        const domain = document.getElementById('hysteriaSetDomain').value.trim();
+        const email = document.getElementById('hysteriaSetEmail').value.trim();
+        const renewSsl = !!opts.renew_ssl;
+        if (!port || port < 1 || port > 65535) {
+            showToast(_('error') + ': invalid port', 'error');
+            return;
+        }
+        if (port === 80) {
+            showToast(_('error') + ': port 80 reserved', 'error');
+            return;
+        }
+        if ((renewSsl || domain) && (!domain || !email)) {
+            showToast(_('error') + ': ' + _('hysteria_ssl_required'), 'error');
+            return;
+        }
+        btn.disabled = true;
+        if (renewBtn) renewBtn.disabled = true;
+        if (renewSsl) {
+            renewText.textContent = _('saving') || 'Saving...';
+            renewSpinner.classList.remove('hidden');
+        } else {
+            text.textContent = _('saving') || 'Saving...';
+            spinner.classList.remove('hidden');
+        }
+        try {
+            const res = await apiCall(`/api/servers/${SERVER_ID}/hysteria/settings`, 'POST', {
+                protocol: proto, port, domain, email, renew_ssl: renewSsl,
+            });
+            showToast(res.message || _('hysteria_settings_saved'), 'success');
+            closeModal('hysteriaSettingsModal');
+            setTimeout(() => checkServer(), 800);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+        } finally {
+            btn.disabled = false;
+            if (renewBtn) renewBtn.disabled = false;
+            text.textContent = _('save');
+            spinner.classList.add('hidden');
+            if (renewText) renewText.textContent = _('hysteria_renew_ssl');
+            if (renewSpinner) renewSpinner.classList.add('hidden');
+        }
+    }
+
+    async function renewHysteriaSsl() {
+        return saveHysteriaSettings({ renew_ssl: true });
+    }
+
     // ========== SOCKS5 Settings ==========
     async function openSocks5Settings(proto = 'socks5') {
         currentSocks5Proto = proto || 'socks5';
@@ -2294,7 +2559,7 @@
                 const sent = userData.dataSent || '';
                 const initial = name.charAt(0).toUpperCase();
                 const enabled = (client.enabled !== undefined) ? client.enabled : (userData.enabled !== false);
-                const hasPrivKey = !!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt';
+                const hasPrivKey = !!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt' || protoBase(proto) === 'hysteria';
                 const assignedUser = client.assigned_user || '';
 
                 let metaHtml = '';
@@ -2332,7 +2597,7 @@
                             </div>
                         </div>
                         <div class="client-actions">
-                            <button class="btn btn-secondary btn-sm btn-icon" onclick="showConnectionConfig('${escapeJs(client.clientId)}', '${escapeJs(name)}', ${!!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt'})" title="${_('config')}">${uiIcon('file')}</button>
+                            <button class="btn btn-secondary btn-sm btn-icon" onclick="showConnectionConfig('${escapeJs(client.clientId)}', '${escapeJs(name)}', ${!!userData.clientPrivateKey || proto === 'xray' || proto === 'telemt' || protoBase(proto) === 'hysteria'})" title="${_('config')}">${uiIcon('file')}</button>
                             ${proto === 'telemt' ? `<button class="btn btn-secondary btn-sm btn-icon" onclick="editConnection('${escapeJs(client.clientId)}')" title="${_('edit')}">${uiIcon('pencil')}</button>` : ''}
                             <button class="btn btn-secondary btn-sm btn-icon" onclick="toggleConnection('${escapeJs(client.clientId)}', ${!enabled})" title="${toggleTitle}">${toggleIcon}</button>
                             <button class="btn btn-danger btn-sm btn-icon" onclick="removeConnection('${escapeJs(client.clientId)}')" title="${_('delete')}">${uiIcon('trash')}</button>
@@ -2384,8 +2649,8 @@
                     document.getElementById('configModalTitle').textContent = `${_('config')} — ${connName}`;
                     document.getElementById('configText').textContent = result.config;
                     document.getElementById('vpnLinkText').textContent = currentVpnLink;
-                    document.getElementById('panel-vpn').style.display = (proto === 'telemt' ? 'none' : '');
+                    document.getElementById('panel-vpn').style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
-                    document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' ? 'none' : '');
+                    document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
                     switchConfigTab('conf');
                     openModal('configModal');
                     generateQR(result.config);
@@ -2463,9 +2728,9 @@
         const proto = document.getElementById('connProtoSelect').value;
 
         // Restore tabs visibility first
-        document.getElementById('panel-vpn').style.display = (proto === 'telemt' ? 'none' : '');
+        document.getElementById('panel-vpn').style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
         document.getElementById('panel-qr').style.display = '';
-        document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' ? 'none' : '');
+        document.querySelectorAll('.config-tab')[1].style.display = (proto === 'telemt' || protoBase(proto) === 'hysteria' ? 'none' : '');
         document.querySelectorAll('.config-tab')[2].style.display = '';
 
         // Client was created via native Amnezia app — private key is not stored server-side

templates/settings.html

@@ -1321,7 +1321,7 @@
     }
 
     const guestServersData = {{ servers | default([]) | tojson }};
-    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt'];
+    const VPN_PROTO_ORDER = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria'];
     const PROTO_TITLES = {
         awg2: 'AmneziaWG 2.0',
         awg: 'AmneziaWG',
@@ -1329,6 +1329,7 @@
         wireguard: 'WireGuard',
         xray: 'Xray (VLESS-Reality)',
         telemt: 'Telemt',
+        hysteria: 'Hysteria 2',
         xui: '3x-ui VLESS',
     };
     function protoTitle(key) {

templates/users.html

@@ -631,7 +631,7 @@
         const select = document.getElementById(selectId);
         const group = groupId ? document.getElementById(groupId) : null;
         select.innerHTML = '';
-        const vpnOrder = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt'];
+        const vpnOrder = ['awg2', 'awg', 'awg_legacy', 'wireguard', 'xray', 'telemt', 'hysteria'];
         const titles = {
             awg2: 'AmneziaWG 2.0',
             awg: 'AmneziaWG',
@@ -639,6 +639,7 @@
             wireguard: 'WireGuard',
             xray: 'Xray (VLESS-Reality)',
             telemt: 'Telemt',
+            hysteria: 'Hysteria 2',
             xui: '3x-ui VLESS',
         };
         const protoTitle = (key) => {

translations/en.json

@@ -350,6 +350,23 @@
   "config_unavailable_desc": "This client was created via the native Amnezia app.\\nThe private key is stored only on the user's device and cannot be recovered by the server.",
   "client_public_key": "Client public key:",
   "telemt_desc": "MTProxy-based Telegram proxy with advanced obfuscation and TLS emulation support.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) via official tobyxdd/hysteria (apernet/hysteria) with Let's Encrypt TLS. Admin sets the domain at install time.",
+  "hysteria_domain": "Domain",
+  "hysteria_email": "Let's Encrypt email",
+  "hysteria_port_hint": "UDP port for Hysteria (default 8998). Avoid 443 if nginx/xray already use UDP/TCP 443. Port 80/TCP must be free for certificate issuance.",
+  "hysteria_install_hint": "Point the domain A-record to this server before install. Port 80/TCP is used temporarily for Let's Encrypt HTTP-01 validation. BBR and salamander obfuscation are enabled automatically.",
+  "hysteria_dns_hint": "Create this DNS record before installation:",
+  "hysteria_settings_title": "Hysteria settings",
+  "hysteria_change_port": "Change port",
+  "hysteria_port_change_hint": "UDP listen port. If you see “address already in use”, pick a free port (e.g. 8443 or 8998), save, then re-import the client link.",
+  "hysteria_settings_saved": "Hysteria settings updated",
+  "hysteria_ports_warning": "Warning: free TCP ports 80 and 443 are required for stable operation (Let's Encrypt on 80, HTTPS/QUIC on 443).",
+  "hysteria_renew_ssl": "Renew SSL",
+  "hysteria_ssl_change_hint": "Changing the domain re-issues the Let's Encrypt certificate (port 80 must be free).",
+  "hysteria_ssl_required": "Domain and email are required for SSL",
+  "server_ssl_domain": "SSL domain (default)",
+  "server_ssl_email": "SSL email (default)",
+  "server_ssl_hint": "Used when installing Hysteria / NGINX on this server (Let's Encrypt).",
   "container_logs": "Container logs",
   "logs_btn": "📋 Logs",
   "logs_live": "Live",

translations/fa.json

@@ -340,6 +340,23 @@
   "clear_server": "پاک‌سازی سرور",
   "remove_server": "حذف سرور از پنل",
   "telemt_desc": "پروکسی تلگرام بر پایه‌ی MTProxy با پوشش‌های پیشرفته.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) با تصویر رسمی tobyxdd/hysteria (apernet/hysteria) و TLS از Let's Encrypt. دامنه را ادمین هنگام نصب مشخص می‌کند.",
+  "hysteria_domain": "دامنه",
+  "hysteria_email": "ایمیل Let's Encrypt",
+  "hysteria_port_hint": "پورت UDP برای Hysteria (پیش‌فرض 8998). اگر 443 اشغال است پورت دیگری بگذارید.",
+  "hysteria_install_hint": "قبل از نصب، رکورد A دامنه باید به این سرور اشاره کند. BBR و obfuscation salamander به‌صورت خودکار فعال می‌شوند.",
+  "hysteria_dns_hint": "قبل از نصب این رکورد DNS را بسازید:",
+  "hysteria_settings_title": "تنظیمات Hysteria",
+  "hysteria_change_port": "تغییر پورت",
+  "hysteria_port_change_hint": "پورت UDP. اگر address already in use دیدید، پورت آزاد بگذارید (8443 یا 8998).",
+  "hysteria_settings_saved": "پورت Hysteria به‌روز شد",
+  "hysteria_ports_warning": "هشدار: برای کار پایدار پورت‌های TCP آزاد ۸۰ و ۴۴۳ لازم است (Let's Encrypt روی ۸۰، HTTPS/QUIC روی ۴۴۳).",
+  "hysteria_renew_ssl": "تمدید SSL",
+  "hysteria_ssl_change_hint": "تغییر دامنه گواهی Let's Encrypt را دوباره صادر می‌کند (پورت ۸۰ باید آزاد باشد).",
+  "hysteria_ssl_required": "برای SSL دامنه و ایمیل لازم است",
+  "server_ssl_domain": "دامنه SSL (پیش‌فرض)",
+  "server_ssl_email": "ایمیل SSL (پیش‌فرض)",
+  "server_ssl_hint": "هنگام نصب Hysteria / NGINX روی این سرور استفاده می‌شود (Let's Encrypt).",
   "container_logs": "لاگ‌های کانتینر",
   "logs_btn": "📋 Logs",
   "logs_live": "زنده",

translations/fr.json

@@ -340,6 +340,23 @@
   "clear_server": "Réinitialiser le serveur",
   "remove_server": "Retirer le serveur du panneau",
   "telemt_desc": "Proxy Telegram basé sur MTProxy avec obfuscation avancée.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) via l'image officielle tobyxdd/hysteria (apernet/hysteria) avec TLS Let's Encrypt. Le domaine est défini par l'admin à l'installation.",
+  "hysteria_domain": "Domaine",
+  "hysteria_email": "Email Let's Encrypt",
+  "hysteria_port_hint": "Port UDP pour Hysteria (8998 par défaut). Évitez 443 s'il est déjà pris.",
+  "hysteria_install_hint": "L'enregistrement A du domaine doit pointer vers ce serveur. BBR et obfuscation salamander sont activés automatiquement.",
+  "hysteria_dns_hint": "Créez cet enregistrement DNS avant l'installation :",
+  "hysteria_settings_title": "Paramètres Hysteria",
+  "hysteria_change_port": "Changer le port",
+  "hysteria_port_change_hint": "Port UDP. Si « address already in use », choisissez un port libre (8443 ou 8998).",
+  "hysteria_settings_saved": "Port Hysteria mis à jour",
+  "hysteria_ports_warning": "Attention : les ports TCP 80 et 443 doivent être libres pour un fonctionnement stable (Let's Encrypt sur 80, HTTPS/QUIC sur 443).",
+  "hysteria_renew_ssl": "Renouveler SSL",
+  "hysteria_ssl_change_hint": "Changer le domaine réémet le certificat Let's Encrypt (le port 80 doit être libre).",
+  "hysteria_ssl_required": "Domaine et email requis pour SSL",
+  "server_ssl_domain": "Domaine SSL (par défaut)",
+  "server_ssl_email": "Email SSL (par défaut)",
+  "server_ssl_hint": "Utilisé lors de l'installation de Hysteria / NGINX sur ce serveur (Let's Encrypt).",
   "container_logs": "Logs du conteneur",
   "logs_btn": "📋 Logs",
   "logs_live": "Temps réel",

translations/ru.json

@@ -350,6 +350,23 @@
   "config_unavailable_desc": "Этот клиент был создан через нативное приложение Amnezia.\\nПриватный ключ хранится только на устройстве пользователя и не может быть восстановлен сервером.",
   "client_public_key": "Публичный ключ клиента:",
   "telemt_desc": "Прокси для Telegram на базе MTProxy с продвинутой обфускацией и эмуляцией TLS.",
+  "hysteria_desc": "Hysteria 2 (QUIC/UDP) на официальном образе tobyxdd/hysteria (apernet/hysteria) с TLS от Let's Encrypt. Домен указывает админ при установке.",
+  "hysteria_domain": "Домен",
+  "hysteria_email": "Email для Let's Encrypt",
+  "hysteria_port_hint": "UDP-порт Hysteria (по умолчанию 8998). Не ставьте 443, если он уже занят nginx/xray. Порт 80/TCP должен быть свободен для выпуска сертификата.",
+  "hysteria_install_hint": "Перед установкой A-запись домена должна указывать на этот сервер. Порт 80/TCP временно используется для HTTP-01 проверки Let's Encrypt. BBR и obfuscation salamander включаются автоматически.",
+  "hysteria_dns_hint": "Перед установкой создайте DNS-запись:",
+  "hysteria_settings_title": "Настройки Hysteria",
+  "hysteria_change_port": "Сменить порт",
+  "hysteria_port_change_hint": "UDP-порт прослушивания. Если ошибка «address already in use» — выберите свободный порт (8443 или 8998), сохраните и заново импортируйте ссылку в клиент.",
+  "hysteria_settings_saved": "Настройки Hysteria обновлены",
+  "hysteria_ports_warning": "Внимание: для стабильной работы нужны свободные TCP-порты 80 и 443 (Let's Encrypt на 80, HTTPS/QUIC на 443).",
+  "hysteria_renew_ssl": "Обновить SSL",
+  "hysteria_ssl_change_hint": "Смена домена заново выпускает сертификат Let's Encrypt (порт 80 должен быть свободен).",
+  "hysteria_ssl_required": "Для SSL нужны домен и email",
+  "server_ssl_domain": "SSL-домен (по умолчанию)",
+  "server_ssl_email": "SSL-email (по умолчанию)",
+  "server_ssl_hint": "Подставляется при установке Hysteria / NGINX на этом сервере (Let's Encrypt).",
   "container_logs": "Логи контейнера",
   "logs_btn": "📋 Логи",
   "logs_live": "В реальном времени",

translations/zh.json

@@ -340,6 +340,23 @@
   "clear_server": "清除服务器",
   "remove_server": "从面板移除服务器",
   "telemt_desc": "基于 MTProxy 的 Telegram 代理，支持高级混淆。",
+  "hysteria_desc": "Hysteria 2（QUIC/UDP，官方 tobyxdd/hysteria / apernet/hysteria），支持 Let's Encrypt TLS。安装时由管理员指定域名。",
+  "hysteria_domain": "域名",
+  "hysteria_email": "Let's Encrypt 邮箱",
+  "hysteria_port_hint": "Hysteria UDP 端口（默认 8998）。若 443 已被占用请换端口。",
+  "hysteria_install_hint": "安装前请将域名 A 记录指向本服务器。将自动启用 BBR 与 salamander 混淆。",
+  "hysteria_dns_hint": "安装前请创建此 DNS 记录：",
+  "hysteria_settings_title": "Hysteria 设置",
+  "hysteria_change_port": "更改端口",
+  "hysteria_port_change_hint": "UDP 监听端口。若提示 address already in use，请改用空闲端口（如 8443 或 8998）。",
+  "hysteria_settings_saved": "Hysteria 端口已更新",
+  "hysteria_ports_warning": "注意：稳定运行需要空闲的 TCP 端口 80 和 443（Let's Encrypt 使用 80，HTTPS/QUIC 使用 443）。",
+  "hysteria_renew_ssl": "续签 SSL",
+  "hysteria_ssl_change_hint": "更改域名会重新签发 Let's Encrypt 证书（需空闲端口 80）。",
+  "hysteria_ssl_required": "签发 SSL 需要域名和邮箱",
+  "server_ssl_domain": "SSL 域名（默认）",
+  "server_ssl_email": "SSL 邮箱（默认）",
+  "server_ssl_hint": "安装 Hysteria / NGINX 时自动填入（Let's Encrypt）。",
   "container_logs": "容器日志",
   "logs_btn": "📋 日志",
   "logs_live": "实时",