feat(mtproto): adopt dolonet/mtg-multi and make MTProto inbounds multi-client

Replace the upstream 9seconds/mtg sidecar with the dolonet/mtg-multi fork so a single MTProto inbound can serve many per-user secrets. Each panel client is now one named FakeTLS secret in the fork's [secrets] section: clients are first-class (attach/detach, limits, expiry, per-client tg:// links) exactly like every other protocol, mirroring the WireGuard multi-client model. Per-client traffic and online status come from the fork's /stats JSON API (its Prometheus output has no per-user label), fed into the existing email-keyed client_traffics accumulator; an optional throttle caps concurrent connections. A one-time seeder converts each legacy single-secret inbound into a one-client inbound.

The fork ships only linux/darwin amd64/arm64 binaries but is pure Go, so provisioning builds it from source for every supported platform (release.yml, DockerInit.sh) while keeping the panel-expected mtg-<os>-<arch> filename and the 'run' verb, so process.go is untouched. Also fixes a pre-existing update.sh gap that never renamed the mtg binary for armv6/armv7 updates.

frontend/src/pages/clients/ClientFormModal.tsx

@@ -24,6 +24,7 @@ import dayjs from 'dayjs';
 import type { Dayjs } from 'dayjs';
 import { HttpUtil, RandomUtil, Wireguard } from '@/utils';
 import { formatInboundLabel } from '@/lib/inbounds/label';
+import { generateMtprotoSecret } from '@/lib/xray/inbound-defaults';
 import { normalizeClientIps, type ClientIpInfo } from '@/lib/clients/ip-log';
 import { DateTimePicker, SelectAllClearButtons } from '@/components/form';
 import { TLS_FLOW_CONTROL } from '@/schemas/primitives';
@@ -35,7 +36,7 @@ const FLOW_OPTIONS = Object.values(TLS_FLOW_CONTROL);
 const VMESS_SECURITY_OPTIONS = ['auto', 'aes-128-gcm', 'chacha20-poly1305', 'none', 'zero'] as const;
 
 const MULTI_CLIENT_PROTOCOLS = new Set([
-  'shadowsocks', 'vless', 'vmess', 'trojan', 'hysteria', 'wireguard',
+  'shadowsocks', 'vless', 'vmess', 'trojan', 'hysteria', 'wireguard', 'mtproto',
 ]);
 
 const CLIENT_FORM_MODAL_Z_INDEX = 1000;
@@ -117,6 +118,7 @@ interface FormState {
   wgPublicKey: string;
   wgPreSharedKey: string;
   wgAllowedIPs: string;
+  secret: string;
 }
 
 function emptyForm(): FormState {
@@ -145,6 +147,7 @@ function emptyForm(): FormState {
     wgPublicKey: '',
     wgPreSharedKey: '',
     wgAllowedIPs: '',
+    secret: '',
   };
 }
 
@@ -249,6 +252,7 @@ export default function ClientFormModal({
         wgPublicKey: client.publicKey || '',
         wgPreSharedKey: client.preSharedKey || '',
         wgAllowedIPs: client.allowedIPs || '',
+        secret: client.secret || '',
       };
       if (et < 0) {
         next.delayedStart = true;
@@ -310,6 +314,22 @@ export default function ClientFormModal({
     return ids;
   }, [inbounds]);
 
+  const mtprotoIds = useMemo(() => {
+    const ids = new Set<number>();
+    for (const row of inbounds || []) {
+      if (row && row.protocol === 'mtproto') ids.add(row.id);
+    }
+    return ids;
+  }, [inbounds]);
+
+  const mtprotoDomain = useMemo(() => {
+    for (const id of form.inboundIds || []) {
+      const ib = (inbounds || []).find((row) => row.id === id);
+      if (ib?.protocol === 'mtproto' && ib.mtprotoDomain) return ib.mtprotoDomain;
+    }
+    return 'www.cloudflare.com';
+  }, [form.inboundIds, inbounds]);
+
   const ss2022Method = useMemo(() => {
     for (const id of form.inboundIds || []) {
       const ib = (inbounds || []).find((row) => row.id === id);
@@ -345,11 +365,20 @@ export default function ClientFormModal({
     [form.inboundIds, wireguardIds],
   );
 
+  const showMtproto = useMemo(
+    () => (form.inboundIds || []).some((id) => mtprotoIds.has(id)),
+    [form.inboundIds, mtprotoIds],
+  );
+
   function regenerateWireguardKeys() {
     const kp = Wireguard.generateKeypair();
     setForm((prev) => ({ ...prev, wgPrivateKey: kp.privateKey, wgPublicKey: kp.publicKey }));
   }
 
+  function regenerateMtprotoSecret() {
+    update('secret', generateMtprotoSecret(mtprotoDomain));
+  }
+
   useEffect(() => {
     if (!showFlow && form.flow) {
 
@@ -373,6 +402,12 @@ export default function ClientFormModal({
     ));
   }, [ss2022Method]);
 
+  useEffect(() => {
+    if (showMtproto && !form.secret) {
+      update('secret', generateMtprotoSecret(mtprotoDomain));
+    }
+  }, [showMtproto, form.secret, mtprotoDomain]);
+
   const inboundOptions = useMemo(
     () => (inbounds || [])
       .filter((ib) => MULTI_CLIENT_PROTOCOLS.has(ib.protocol || ''))
@@ -502,6 +537,10 @@ export default function ClientFormModal({
       }
     }
 
+    if (showMtproto) {
+      clientPayload.secret = form.secret;
+    }
+
     const externalLinks: ExternalLinkInput[] = form.externalLinks
       .map((r) => ({ kind: r.kind, value: r.value.trim(), remark: '' }))
       .filter((r) => r.value !== '');
@@ -822,6 +861,14 @@ export default function ClientFormModal({
                         </Form.Item>
                       </>
                     )}
+                    {showMtproto && (
+                      <Form.Item label={t('pages.clients.mtprotoSecret')} extra={t('pages.clients.mtprotoSecretHint')}>
+                        <Space.Compact style={{ display: 'flex' }}>
+                          <Input value={form.secret} style={{ flex: 1 }} onChange={(e) => update('secret', e.target.value)} />
+                          <Button aria-label={t('regenerate')} icon={<ReloadOutlined />} onClick={regenerateMtprotoSecret} />
+                        </Space.Compact>
+                      </Form.Item>
+                    )}
                   </>
                 ),
               },

frontend/src/pages/inbounds/form/protocols/mtproto.tsx

@@ -1,8 +1,6 @@
 import { useTranslation } from 'react-i18next';
-import { Button, Form, Input, InputNumber, Select, Space, Switch } from 'antd';
-import { ReloadOutlined } from '@ant-design/icons';
+import { Form, Input, InputNumber, Select, Switch } from 'antd';
 
-import { generateMtprotoSecret, mtprotoSecretForDomain } from '@/lib/xray/inbound-defaults';
 import { useOutboundTags } from '@/api/queries/useOutboundTags';
 
 export default function MtprotoFields() {
@@ -12,29 +10,12 @@ export default function MtprotoFields() {
   const { data: outboundTags } = useOutboundTags();
   return (
     <>
-      <Form.Item name={['settings', 'fakeTlsDomain']} label={t('pages.inbounds.form.fakeTlsDomain')}>
-        <Input
-          placeholder="www.cloudflare.com"
-          onChange={(e) => {
-            const current = (form.getFieldValue(['settings', 'secret']) as string) ?? '';
-            form.setFieldValue(['settings', 'secret'], mtprotoSecretForDomain(current, e.target.value));
-          }}
-        />
-      </Form.Item>
-      <Form.Item label={t('pages.inbounds.form.mtprotoSecret')}>
-        <Space.Compact block>
-          <Form.Item name={['settings', 'secret']} noStyle>
-            <Input readOnly style={{ width: 'calc(100% - 32px)' }} />
-          </Form.Item>
-          <Button
-            aria-label={t('regenerate')}
-            icon={<ReloadOutlined />}
-            onClick={() => {
-              const domain = form.getFieldValue(['settings', 'fakeTlsDomain']);
-              form.setFieldValue(['settings', 'secret'], generateMtprotoSecret(domain as string));
-            }}
-          />
-        </Space.Compact>
+      <Form.Item
+        name={['settings', 'fakeTlsDomain']}
+        label={t('pages.inbounds.form.fakeTlsDomain')}
+        tooltip={t('pages.inbounds.form.mtprotoFakeTlsDomainHint')}
+      >
+        <Input placeholder="www.cloudflare.com" />
       </Form.Item>
       <Form.Item
         name={['settings', 'domainFronting', 'ip']}
@@ -75,6 +56,13 @@ export default function MtprotoFields() {
       <Form.Item name={['settings', 'debug']} label={t('pages.inbounds.form.mtgDebug')} valuePropName="checked">
         <Switch />
       </Form.Item>
+      <Form.Item
+        name={['settings', 'throttleMaxConnections']}
+        label={t('pages.inbounds.form.mtgThrottleMaxConnections')}
+        tooltip={t('pages.inbounds.form.mtgThrottleMaxConnectionsHint')}
+      >
+        <InputNumber min={0} placeholder="0" style={{ width: '100%' }} />
+      </Form.Item>
       <Form.Item
         name={['settings', 'routeThroughXray']}
         label={t('pages.inbounds.form.mtgRouteThroughXray')}

frontend/src/pages/inbounds/info/InboundInfoModal.tsx

@@ -633,15 +633,6 @@ export default function InboundInfoModal({
             <dt>{t('pages.inbounds.form.fakeTlsDomain')}</dt>
             <dd><Tag color="green" className="value-tag">{inbound.settings.fakeTlsDomain as string}</Tag></dd>
           </div>
-          <div className="info-row">
-            <dt>{t('pages.inbounds.form.mtprotoSecret')}</dt>
-            <dd className="value-block">
-              <code className="value-code">{inbound.settings.secret as string}</code>
-              <Tooltip title={t('copy')}>
-                <Button size="small" className="value-copy" icon={<CopyOutlined />} aria-label={t('copy')} onClick={() => copyText(inbound.settings.secret as string, t)} />
-              </Tooltip>
-            </dd>
-          </div>
           {(() => {
             const s = inbound.settings;
             const df = s.domainFronting as { ip?: string; port?: number; proxyProtocol?: boolean } | undefined;
@@ -683,17 +674,6 @@ export default function InboundInfoModal({
               </>
             );
           })()}
-          {links.length > 0 && (
-            <div className="info-row">
-              <dt>{t('pages.inbounds.copyLink')}</dt>
-              <dd className="value-block">
-                <code className="value-code">{links[0].link}</code>
-                <Tooltip title={t('copy')}>
-                  <Button size="small" className="value-copy" icon={<CopyOutlined />} aria-label={t('copy')} onClick={() => copyText(links[0].link, t)} />
-                </Tooltip>
-              </dd>
-            </div>
-          )}
         </dl>
       )}
 

frontend/src/pages/inbounds/info/helpers.ts

@@ -16,6 +16,7 @@ const LINK_PROTOCOLS: ReadonlySet<string> = new Set([
   Protocols.TROJAN,
   Protocols.SHADOWSOCKS,
   Protocols.HYSTERIA,
+  Protocols.MTPROTO,
 ]);
 
 export function hasShareLink(protocol: string): boolean {

frontend/src/pages/inbounds/list/helpers.ts

@@ -72,6 +72,7 @@ export function isInboundMultiUser(record: { protocol: string; settings: unknown
     case 'vless':
     case 'trojan':
     case 'hysteria':
+    case 'mtproto':
       return true;
     case 'shadowsocks':
       return isSSMultiUser({ protocol: 'shadowsocks', settings: readSettings(record.settings) });