release: v1.5.0

Promotes v1.5.0-beta.1 to stable. Ships the beta's backend features —
quality-aware NodeCircle rotation (best mode + max_latency/min_speed
filters + smart-skip), background auto speed-checks, the unified
reachability-gated speed test (avg after warm-up + peak), login lockout
and opt-in GeoIP flags (DB migrations 019-022) — alongside a UI-framework
refresh and network hardening.

UI framework: Tailwind v3 -> v4 (CSS-first @theme) on the TailAdmin
palette while keeping PiTun's variable structure; light-theme contrast
fixed page by page. tailwind.config.ts is gone (config is now CSS).

Localisation: a Russian sweep across pages that lacked useT (GeoData,
Balancers, Diagnostics, Logs, Login, routing/rule editors, ...), keeping
technical terms in English.

Routing self-loop protection: state read, apply and the gateway probe
refuse a default route that points at the box's own IP; the Network page
flags it in red. Install/deploy scripts add an IP==GATEWAY guard, check
ports 53/5353, remove the native systemd-resolved and make resolv.conf a
static PiTun-owned file so hostname resolution stays reliable;
03-deploy.sh self-heals already-installed boxes.

UX: sidebar reordered with thin separators, a scrollable nav that never
exceeds the viewport, and distinct icons (Balancers off the Nodes glyph).
"Speed All" reuses the background sweep so a large node set can't 504.

Docs: README (EN+RU) feature list refreshed; Knowledge Base gains Speed
Tests & Node Health, Host Network, Direct Connection, Updates and TLS
Fragment sections and updated Node Circles / Subscriptions / Security,
all bilingual.

No new migrations beyond the beta's 019-022; schema unchanged since
v1.5.0-beta.1. Relevant backend suites (network, autocheck, speedtest,
nodecircle, auth, dns, system) pass; frontend build + 82 tests green.

Author: DaveBugg

CHANGELOG.md

@@ -4,6 +4,52 @@ All notable user-facing changes to PiTun. Full per-release detail lives in the
 [GitHub Releases](https://github.com/DaveBugg/PiTun/releases); this file is the
 committed summary.
 
+## v1.5.0 — 2026-08-05
+
+Promotes v1.5.0-beta.1 to stable and lands a UI-framework refresh, a full
+Russian translation sweep, and hardening against the "gateway points at itself"
+install footgun. Everything from the beta — quality-aware NodeCircle rotation,
+background auto speed-checks, the unified reachability-gated speed test, login
+lockout and opt-in GeoIP flags (DB migrations 019–022) — ships here.
+
+### Added
+
+- **Routing self-loop protection (Settings → Network).** State read, apply and
+  the gateway probe now detect and refuse a default route that points at the
+  box's own IP — the "a new device set its PiTun gateway to itself" footgun.
+  The Network page flags it in red and blocks re-applying a self-referential
+  gateway; the install/deploy scripts add an `IP == GATEWAY` guard so the loop
+  can't be baked in at first boot.
+- **Knowledge Base + README refresh.** New KB sections (Speed Tests & Node
+  Health, Host Network, Direct Connection, Updates, TLS Fragment) plus updated
+  Node Circles / Subscriptions / Security sections, all bilingual EN/RU; the
+  README feature list and version pins were brought up to date.
+
+### Changed
+
+- **UI framework: Tailwind v3 → v4** (CSS-first `@theme`) with the TailAdmin
+  palette as the base, keeping PiTun's variable structure. Light-theme contrast
+  fixed page by page.
+- **Russian localisation sweep.** Pages that lacked `useT` (GeoData, Balancers,
+  Diagnostics, Logs, Login, routing / rule editors, …) are now translated, with
+  technical terms kept in English.
+- **Sidebar** reordered into logical groups with thin separators, a scrollable
+  nav that never exceeds the viewport, and distinct icons (Balancers no longer
+  shares the Nodes glyph).
+- **Install / deploy DNS hardening.** `02-install-stack.sh`, `03-deploy.sh` and
+  `setup-vm.sh` now check ports 53 / 5353, remove the native `systemd-resolved`,
+  and make `/etc/resolv.conf` a static PiTun-owned file so the box's own name
+  resolution (hostname) stays reliable; `03-deploy.sh` self-heals already-
+  installed boxes on the next deploy.
+
+### Fixed
+
+- **"Speed All" no longer 504s** — it reuses the background auto-check sweep
+  (one-off, forced scope "all"), so a large node set can't time out at the
+  reverse proxy; the sweep order now checks the newest nodes first.
+- A latent `warn: command not found` (`set -e` crash path) in
+  `02-install-stack.sh`.
+
 ## v1.5.0-beta.1 — 2026-08-04
 
 **Beta.** Smarter node-circle rotation driven by real speed data, an automatic

README.md

@@ -278,9 +278,16 @@ Frontend is a single-page React app served by nginx.
 - QUIC (UDP/443) blocking — forces TCP fallback for protocols TPROXY
   can intercept
 - Tunnel chaining — VLESS-inside-WireGuard, etc.
+- **Recursive multi-hop chains** — `config_gen` follows `chain_node_id`
+  transitively, wiring every hop (exit → mid → entry) with cycle
+  detection and a depth cap (WireGuard is exit-hop only)
 - **Proxy Chains** (multi-panel, two-hop VLESS+Reality across two
   x-ui panels with independent channels per chain; managed clients
   + per-channel delete + live healthcheck)
+- **TLS ClientHello fragmentation (anti-DPI)** — a Settings toggle
+  splits the outgoing ClientHello across several packets so a DPI box
+  can't match the SNI in a single read; entirely client-side, tunable
+  packet mode / length / interval, off by default (needs bundled xray 26.x)
 - Kill switch — drop all forwarded traffic if xray crashes
 
 **Routing**
@@ -295,38 +302,64 @@ Frontend is a single-page React app served by nginx.
   gambling, "Work" set routes corp domains direct). Assign devices
   individually or in bulk; per-set rules apply first, then fall through
   to global rules. DHCP-resistant (MAC-based via dedicated per-set
-  loopback TPROXY ports + xray `inboundTag` matching)
+  loopback TPROXY ports + xray `inboundTag` matching). Set-aware
+  **export/import** — pick scopes, resolve conflicts, import into
+  Global / an existing / a new set
+- **Route Explainer** — paste a domain, URL or IP and see which rule
+  wins and whether it exits proxied, direct or blocked
 
 **Health & resilience**
 - Background liveness probe with two-tier auto-failover: if the failed
   node belongs to an enabled NodeCircle, the failover handler delegates
   recovery to the circle (which skips dead siblings via pre-ping +
   retry); otherwise it walks a configurable fallback list
-- Speed test per node via short-lived isolated xray instance
+- **Unified speed test** — gates on reachability first (Google /
+  Cloudflare 204 with a retry, so a dead node fails in ~1s instead of
+  grinding every fallback), then measures the **average after warm-up
+  plus the peak**; streams live, persists both numbers, and flags a
+  reading older than 6h as stale
+- **Automatic background speed checks** — sweep a chosen scope (all /
+  a subscription / a group / specific nodes) on an interval so `best` /
+  `min_speed` and the UI stay fresh without manual testing; sequential,
+  staleness-guarded, with per-node error isolation
+- One-tap **reachability check** — confirms a node actually carries
+  traffic to the internet (204 through the live tunnel), separate from
+  raw link speed
 - Naive sidecar supervisor — auto-restarts crashed Naive containers
   with a sliding-window rate limiter
 - Recent Events feed on Dashboard surfaces failovers, sidecar
   restarts, geo updates, circle rotations
 
 **Balancing & rotation**
 - Balancer groups (xray's `leastPing` or `random` strategies)
-- Node Circles — automatically rotate the active node on a schedule,
-  seamlessly via xray's gRPC API (no dropped connections); each
-  candidate is TCP-pinged with a single retry before switching, so
-  dead siblings are skipped without a connection blip
+- Node Circles — schedule seamless active-node rotation via xray's gRPC
+  API (no dropped connections). A **`best`** mode plus **`max_latency_ms`**
+  and **`min_speed_mbps`** candidate filters pick from real speed data
+  (never-tested nodes get the benefit of the doubt), and a **smart-skip**
+  keeps a scheduled rotation from moving off a healthy, low-latency node
+  — manual "rotate now" always rotates
 
 **Subscriptions**
 - Periodic refresh from VLESS / VMess / Trojan / SS / Hysteria2 /
   Clash YAML / xray JSON subscription URLs
-- Per-subscription User-Agent (v2ray, clash, sing-box, happ, …),
-  optional regex filter, configurable interval
+- **User-Agent templates** — an editable table (add / edit / delete)
+  replacing the old hardcoded presets; each row carries a UA string and
+  optional custom request headers, with catalogue export / import
+- Optional **GeoIP country flags** on imported node names (`🇳🇱 vless-nl`)
+  — opt-in and licence-clean (drop a MaxMind `GeoLite2-Country.mmdb`
+  next to the geo data; absent it's a silent no-op)
+- Optional regex filter, configurable interval
 
 **Devices & DNS**
 - LAN discovery via `arp-scan`, OUI vendor lookup
 - Per-device routing policy (default / always-include / always-bypass)
 - Per-domain DNS rules (plain, DoH, DoT)
 - FakeDNS pool for sniffing-friendly geoip resolution
 - DNS query log with stats
+- **Host network controls** — change the box's own gateway / DNS from
+  Settings → Network with an auto-backup + one-click rollback; warns on
+  a routing self-loop (gateway pointing at the box itself) or a
+  double-hop through another PiTun
 
 **Servers & deployments**
 - Inventory of remote VPS hosts (host, SSH credentials, tags) separate
@@ -336,22 +369,35 @@ Frontend is a single-page React app served by nginx.
 - One-click auto-deploy over SSH for **NaiveProxy**, **WireGuard**,
   **x-ui** (3x-ui / x-ui-pro) — live log streaming, status badges,
   cascade-clean on uninstall
+- **Per-page Direct switch** — every server / panel / chain SSH
+  operation runs *through the active node* by default (the same tunnel
+  the LAN uses); a Direct toggle flips one operation back to a straight
+  dial for reaching a box while the active node is down
 - Dedicated **X-ui Panels** page — full inbound + client management
   (6 wired presets covering Reality / TLS / domain modes), live
   healthcheck (panel API, xray, nginx, UFW, TLS cert, disk, mem),
   cache↔panel sync for hand-added clients, random / custom
   fakesite rotation
+- **SNI / REALITY-dest scanner** in the node form — probe a candidate
+  host for TLS 1.3 + HTTP/2 before saving it as the masquerade target
 
 **Operations**
 - One-click GeoIP / GeoSite refresh — three switchable upstream
   profiles: Loyalsoldier (CN-focused community list), runetfreedom
   (Russian-internet curated list), v2fly (vanilla baseline)
+- **In-UI self-update** — Settings → Updates checks GitHub (through the
+  active node, so a throttled direct route isn't a blocker), shows
+  what's new and applies it with live progress via a host-side agent
 - Full-fidelity JSON Export/Import for Nodes and Servers — versioned
   bundle envelope, append/replace modes, optional secret redaction
   (separate from URI/subscription import which is single-node only)
 - Plain-text URI export (`.txt`, one `vless://…` per line) — share
   your node list with any v2rayN-compatible client; symmetric
-  `Import` button auto-detects URI list vs JSON bundle
+  `Import` button auto-detects URI list vs JSON bundle. Single-node URI
+  export straight from a node card too
+- **Login lockout** — five consecutive failed logins lock an account
+  for 15 minutes (HTTP 429 + `Retry-After`); the primary LAN-only
+  brute-force guard
 - Built-in diagnostics page (DNS reachability, gateway, xray status,
   resource usage)
 - Streaming xray log viewer
@@ -411,30 +457,30 @@ curl -fsSL https://raw.githubusercontent.com/DaveBugg/PiTun/master/install.sh |
 > ```bash
 > curl -fsSL https://raw.githubusercontent.com/DaveBugg/PiTun/master/install.sh \
 >      -o /tmp/pitun-install.sh
-> sudo bash /tmp/pitun-install.sh --version v1.3.0-beta.8
+> sudo bash /tmp/pitun-install.sh --version v1.4.12
 > ```
 >
 > **(B) Pipe with `bash -s --` separator** (the `-s --` is **required**):
 > ```bash
 > curl -fsSL https://raw.githubusercontent.com/DaveBugg/PiTun/master/install.sh \
->      | sudo bash -s -- --version v1.3.0-beta.8
+>      | sudo bash -s -- --version v1.4.12
 > ```
 >
 > **(C) Environment variable** (no `-s --` voodoo needed):
 > ```bash
 > curl -fsSL https://raw.githubusercontent.com/DaveBugg/PiTun/master/install.sh \
->      | sudo PITUN_VERSION=v1.3.0-beta.8 bash
+>      | sudo PITUN_VERSION=v1.4.12 bash
 > ```
 >
-> ❌ **Do NOT do this:** `curl ... | sudo bash --version v1.3.0-beta.8` — bash
+> ❌ **Do NOT do this:** `curl ... | sudo bash --version v1.4.12` — bash
 > swallows `--version` as its own flag (prints bash's version + exits)
 > before our installer ever runs. Common copy-paste trap.
 
 Useful flags (work via any of the three forms above; examples use form B):
 
 ```bash
-# Pin a specific version (current: v1.3.0-beta.8)
-... | sudo bash -s -- --version v1.3.0-beta.8
+# Pin a specific version (example tag — see GitHub Releases for the latest)
+... | sudo bash -s -- --version v1.4.12
 
 # Force rebuilding from source (no published release available, or
 # you're testing local changes). Slower, needs reliable internet