feat(mtproto): adopt dolonet/mtg-multi and make MTProto inbounds multi-client

Replace the upstream 9seconds/mtg sidecar with the dolonet/mtg-multi fork so a single MTProto inbound can serve many per-user secrets. Each panel client is now one named FakeTLS secret in the fork's [secrets] section: clients are first-class (attach/detach, limits, expiry, per-client tg:// links) exactly like every other protocol, mirroring the WireGuard multi-client model. Per-client traffic and online status come from the fork's /stats JSON API (its Prometheus output has no per-user label), fed into the existing email-keyed client_traffics accumulator; an optional throttle caps concurrent connections. A one-time seeder converts each legacy single-secret inbound into a one-client inbound.

The fork ships only linux/darwin amd64/arm64 binaries but is pure Go, so provisioning builds it from source for every supported platform (release.yml, DockerInit.sh) while keeping the panel-expected mtg-<os>-<arch> filename and the 'run' verb, so process.go is untouched. Also fixes a pre-existing update.sh gap that never renamed the mtg binary for armv6/armv7 updates.

internal/web/job/mtproto_job.go

@@ -10,8 +10,8 @@ import (
 
 // MtprotoJob reconciles the running mtg sidecar processes against the enabled
 // mtproto inbounds in the database, restarts any that crashed, and folds the
-// per-inbound traffic scraped from each mtg metrics endpoint into the usual
-// inbound traffic accounting.
+// per-client traffic scraped from each mtg /stats endpoint into the usual client
+// and inbound traffic accounting.
 type MtprotoJob struct {
 	inboundService service.InboundService
 }
@@ -21,8 +21,8 @@ func NewMtprotoJob() *MtprotoJob {
 	return new(MtprotoJob)
 }
 
-// Run reconciles desired mtproto inbounds with running mtg processes and
-// records traffic deltas.
+// Run reconciles desired mtproto inbounds with running mtg processes and records
+// per-client traffic deltas and online status.
 func (j *MtprotoJob) Run() {
 	inbounds, err := j.inboundService.GetAllInbounds()
 	if err != nil {
@@ -32,12 +32,14 @@ func (j *MtprotoJob) Run() {
 
 	var desired []mtproto.Instance
 	routedTags := make(map[string]bool)
+	activeTags := make([]string, 0)
 	for _, ib := range inbounds {
 		if ib.Protocol != model.MTProto || !ib.Enable || ib.NodeID != nil {
 			continue
 		}
 		if inst, ok := mtproto.InstanceFromInbound(ib); ok {
 			desired = append(desired, inst)
+			activeTags = append(activeTags, inst.Tag)
 			if inst.RouteThroughXray {
 				routedTags[inst.Tag] = true
 			}
@@ -47,29 +49,41 @@ func (j *MtprotoJob) Run() {
 	mgr := mtproto.GetManager()
 	mgr.Reconcile(desired)
 
-	deltas := mgr.CollectTraffic()
-	if len(deltas) == 0 {
-		return
-	}
-	traffics := make([]*xray.Traffic, 0, len(deltas))
+	deltas, onlineEmails := mgr.CollectTraffic()
+
+	// A routed inbound's total is already metered through the Xray bridge by
+	// xray_traffic_job, so only non-routed inbounds are rolled up here; per-client
+	// deltas are always kept, since the bridge cannot tell mtproto users apart.
+	clientTraffics := make([]*xray.ClientTraffic, 0, len(deltas))
+	inboundUp := make(map[string]int64)
+	inboundDown := make(map[string]int64)
 	for _, d := range deltas {
-		// Routed inbounds egress through the Xray SOCKS bridge, which carries the
-		// inbound's tag and is metered by xray_traffic_job. Folding mtg's own
-		// metrics in too would double-count, so skip them here.
-		if routedTags[d.Tag] {
-			continue
+		clientTraffics = append(clientTraffics, &xray.ClientTraffic{
+			Email: d.Email,
+			Up:    d.Up,
+			Down:  d.Down,
+		})
+		if !routedTags[d.Tag] {
+			inboundUp[d.Tag] += d.Up
+			inboundDown[d.Tag] += d.Down
 		}
+	}
+
+	traffics := make([]*xray.Traffic, 0, len(inboundUp))
+	for tag, up := range inboundUp {
 		traffics = append(traffics, &xray.Traffic{
 			IsInbound: true,
-			Tag:       d.Tag,
-			Up:        d.Up,
-			Down:      d.Down,
+			Tag:       tag,
+			Up:        up,
+			Down:      inboundDown[tag],
 		})
 	}
-	if len(traffics) == 0 {
-		return
-	}
-	if _, _, err := j.inboundService.AddTraffic(traffics, nil); err != nil {
-		logger.Warning("mtproto job: add traffic failed:", err)
+
+	if len(traffics) > 0 || len(clientTraffics) > 0 {
+		if _, _, err := j.inboundService.AddTraffic(traffics, clientTraffics); err != nil {
+			logger.Warning("mtproto job: add traffic failed:", err)
+		}
 	}
+
+	j.inboundService.RefreshLocalOnlineClients(onlineEmails, activeTags)
 }