Two large subsystems land in this release — cluster management and one-click ACME. Both are shipping for the first time here and have not had a real-world shakedown yet. Back up your db/ folder before upgrading, and read the two warnings below.

⚠️ Before you upgrade

Downgrading is one-way once you have adopted a cluster node. Older binaries don't know the node_id column. Roll a database that contains adopted replicas back to 1.5.x and the old binary hands the remote node's ports to its own local core, putting the panel into a ~15s restart loop. De-adopt every node before downgrading.

If your panel already has webNginx set, check its scheme after upgrading. Earlier versions turned webNginx on automatically whenever nginx was detected on the host, so some installs carry the flag without ever having chosen it. Those panels keep serving plain HTTP after the upgrade, and in reverse-proxy mode the certificate-path inputs are hidden — so a stale value cannot be cleared from the UI. If that locks you out, SSH in and run UPDATE settings SET value='false' WHERE key='webNginx'; against the panel database, then restart. While diagnosing, don't rely on sui uri — it was reworked in this release — check ss -lntp and curl -I directly.

Cluster management #29 #53

Run several 2S-UI panels from one master. A node is just another full 2S-UI install: the master drives it through the node's existing apiv2 with a Token header, so nodes need no agent and no upgrade — older versions can be adopted as they are.

• 5s heartbeat monitoring for every node
• Adopt a node's inbounds into the master, which then holds the single authoritative ledger for users
• Shared clients across nodes, with node traffic reconciled back into the master's ledger by baseline diffing, plus cluster-wide quota and enable/disable
• Node routes are aggregated into the master's subscription as [node name] tag entries
• Deleting a node that still has live replicas is refused — de-adopt first

One-click ACME certificates #55

Issue a certificate from the panel with the validation method picked automatically — standalone, or an nginx block when a reverse proxy fronts the panel — and an automatic proxy reload on renewal.

• sui uri now reports the configured panel URI and the subscription address, and no longer claims https for a panel that a proxy fronts
• Standalone validation binds IPv6 on v6-only hosts
• Failures name the actual cause — missing conf.d, denied :80 — instead of failing generically
• ACME is hidden on Windows, where it does not apply

Enhancements #61

• Latency test for endpoints, one at a time or all at once
• Enable or disable a client straight from the client list
• Hysteria port hopping on the outbound form
• Shadowsocks plugin and plugin_opts support
• The panel reports the server OS

Bug Fixes

• Editing one user no longer disconnects every other user on the same inbound. Users are now updated in place instead of rebuilding the listener, which used to destroy the QUIC session for anytls, hysteria, hysteria2, tuic, vless, vmess and trojan #60
• Rework Clash proxy-group assembly and ws headers, emit max-early-data, and stop aliasing the default group slice #59
• Carry ws early data into generated share links #59
• Omit a disabled tls block from the core config #59
• Keep the ACME section visible when it is already configured #61