feat: migrate MTProxyMax to Gitea + bump telemt engine to v3.0.13

- All install/README URLs point to git.samnet.dev - Container registry switched to Gitea - GitHub Actions converted to Gitea Actions - Engine bumped from v3.0.7 to v3.0.13 (TLS full cert, ME stability, pool hardswap) - Self-update mechanism stays on GitHub (pending account restoration)
2026-02-24 00:07:58 -06:00
commit d32e474025
8 changed files with 6555 additions and 0 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+* text=auto
+*.sh text eol=lf
+LICENSE text eol=lf
--- a/.gitea/workflows/build-engine.yml
+++ b/.gitea/workflows/build-engine.yml
@@ -0,0 +1,74 @@
+name: Build Telemt Engine
+
+on:
+  workflow_dispatch:
+    inputs:
+      telemt_commit:
+        description: 'Telemt commit hash to build from'
+        required: true
+        default: 'd38d7f2'
+      version_tag:
+        description: 'Version tag (e.g. 3.0.13-d38d7f2)'
+        required: true
+        default: '3.0.13-d38d7f2'
+
+env:
+  REGISTRY: git.samnet.dev
+  IMAGE_NAME: mtproxymax-telemt
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Set up QEMU (for ARM builds)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Create Dockerfile
+        run: |
+          cat > Dockerfile <<'DEOF'
+          FROM rust:1-bookworm AS builder
+          ARG TELEMT_REPO=telemt/telemt
+          ARG TELEMT_COMMIT
+          RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+          RUN git clone "https://github.com/${TELEMT_REPO}.git" /build
+          WORKDIR /build
+          RUN git checkout "${TELEMT_COMMIT}"
+          ENV CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 CARGO_PROFILE_RELEASE_DEBUG=false
+          RUN cargo build --release && strip target/release/telemt 2>/dev/null || true && cp target/release/telemt /telemt
+          FROM debian:bookworm-slim
+          RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+          COPY --from=builder /telemt /usr/local/bin/telemt
+          RUN chmod +x /usr/local/bin/telemt
+          STOPSIGNAL SIGINT
+          ENTRYPOINT ["telemt"]
+          DEOF
+          sed -i 's/^          //' Dockerfile
+
+      - name: Lowercase owner
+        id: owner
+        run: echo "name=$(echo '${{ gitea.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push multi-arch image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          build-args: |
+            TELEMT_COMMIT=${{ github.event.inputs.telemt_commit }}
+          tags: |
+            ${{ env.REGISTRY }}/${{ steps.owner.outputs.name }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.version_tag }}
+            ${{ env.REGISTRY }}/${{ steps.owner.outputs.name }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,3 @@
+__pycache__/
+*.pyc
+.claude/
--- a/21
+++ b/21
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SamNet Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/README.md
+++ b/README.md
@@ -0,0 +1,557 @@
+<p align="center">
+  <h1 align="center">MTProxyMax</h1>
+  <p align="center"><b>The Ultimate Telegram MTProto Proxy Manager</b></p>
+  <p align="center">
+    One script. Full control. Zero hassle.
+  </p>
+  <p align="center">
+    <img src="https://img.shields.io/badge/version-1.2.0-brightgreen" alt="Version"/>
+    <img src="https://img.shields.io/badge/license-MIT-blue" alt="License"/>
+    <img src="https://img.shields.io/badge/engine-Rust_(telemt_3.x)-orange" alt="Engine"/>
+    <img src="https://img.shields.io/badge/platform-Linux-lightgrey" alt="Platform"/>
+    <img src="https://img.shields.io/badge/bash-4.2+-yellow" alt="Bash"/>
+    <img src="https://img.shields.io/badge/docker-multi--arch-blue" alt="Docker"/>
+  </p>
+  <p align="center">
+    <a href="#-quick-start">Quick Start</a> &bull;
+    <a href="#-features">Features</a> &bull;
+    <a href="#-comparison">Comparison</a> &bull;
+    <a href="#-telegram-bot-17-commands">Telegram Bot</a> &bull;
+    <a href="#-cli-reference">CLI Reference</a> &bull;
+    <a href="#-changelog">Changelog</a>
+  </p>
+</p>
+
+---
+
+MTProxyMax is a full-featured Telegram MTProto proxy manager powered by the **telemt 3.x Rust engine**. It wraps the raw proxy engine with an interactive TUI, a complete CLI, a Telegram bot for remote management, per-user access control, traffic monitoring, proxy chaining, and automatic updates — all in a single bash script.
+
+<img src="main.png" width="600" alt="MTProxyMax Main Menu"/>
+
+```bash
+sudo bash -c "$(curl -fsSL https://git.samnet.dev/SamNet-dev/MTProxyMax/raw/branch/main/install.sh)"
+```
+
+---
+
+## Why MTProxyMax?
+
+Most MTProxy tools give you a proxy and a link. That's it. MTProxyMax gives you a **full management platform**:
+
+- 🔐 **Multi-user secrets** with individual bandwidth quotas, device limits, and expiry dates
+- 🤖 **Telegram bot** with 17 commands — manage everything from your phone
+- 🖥️ **Interactive TUI** — no need to memorize commands, menu-driven setup
+- 📊 **Prometheus metrics** — real per-user traffic stats, not just iptables guesses
+- 🔗 **Proxy chaining** — route through SOCKS5 upstreams for extra privacy
+- 🔄 **Auto-recovery** — detects downtime, restarts automatically, alerts you on Telegram
+- 🐳 **Pre-built Docker images** — installs in seconds, not minutes
+
+---
+
+## 🚀 Quick Start
+
+### One-Line Install
+
+```bash
+sudo bash -c "$(curl -fsSL https://git.samnet.dev/SamNet-dev/MTProxyMax/raw/branch/main/install.sh)"
+```
+
+The interactive wizard walks you through everything: port, domain, first user secret, and optional Telegram bot setup.
+
+### Manual Install
+
+```bash
+curl -fsSL https://git.samnet.dev/SamNet-dev/MTProxyMax/raw/branch/main/mtproxymax.sh -o mtproxymax
+chmod +x mtproxymax
+sudo ./mtproxymax install
+```
+
+### After Install
+
+```bash
+mtproxymax           # Open interactive TUI
+mtproxymax status    # Check proxy health
+```
+
+---
+
+## ✨ Features
+
+### 🛡️ FakeTLS V2 Obfuscation
+
+Your proxy traffic looks identical to normal HTTPS traffic. The **Fake TLS V2** engine mirrors real TLS 1.3 sessions — per-domain profiles, real cipher suites, dynamic certificate lengths, and realistic record fragmentation. The TLS handshake SNI points to a cover domain (e.g., `cloudflare.com`), making it indistinguishable from regular web browsing to any DPI system.
+
+**Traffic masking** goes further — when a non-Telegram client probes your server, the connection is forwarded to the real cover domain. Your server responds exactly like cloudflare.com would.
+
+---
+
+### 👥 Multi-User Secret Management
+
+Each user gets their own **secret key** with a human-readable label:
+
+- **Add/remove** users instantly — config regenerates and proxy hot-reloads
+- **Enable/disable** access without deleting the key
+- **Rotate** a user's secret — new key, same label, old link stops working
+- **QR codes** — scannable directly in Telegram
+
+---
+
+### 🔒 Per-User Access Control
+
+Fine-grained limits enforced at the engine level:
+
+| Limit | Description | Example |
+|-------|-------------|---------|
+| **Max Connections** | Simultaneous TCP connections | `100` |
+| **Max IPs** | Unique devices/IPs allowed | `5` |
+| **Data Quota** | Total bandwidth cap | `10G`, `500M` |
+| **Expiry Date** | Auto-disable after date | `2026-12-31` |
+
+```bash
+mtproxymax secret setlimits alice 100 5 10G 2026-12-31
+```
+
+---
+
+### 📋 User Management Recipes
+
+<details>
+<summary><b>Prevent Key Sharing</b></summary>
+
+```bash
+mtproxymax secret setlimit alice ips 1    # Single person only
+mtproxymax secret setlimit family ips 5   # Family of up to 5 devices
+```
+
+If someone with `ips 1` shares their link, the second device gets rejected automatically.
+
+</details>
+
+<details>
+<summary><b>IP Limit Tiers</b></summary>
+
+| Scenario | `max_ips` |
+|----------|-----------|
+| Single person, one device | `1` |
+| Single person, multiple devices | `2-3` |
+| Small family | `5` |
+| Small group / office | `20-30` |
+| Public/open link | `0` (unlimited) |
+
+</details>
+
+<details>
+<summary><b>Time-Limited Sharing Link</b></summary>
+
+```bash
+mtproxymax secret add shared-link
+mtproxymax secret setlimits shared-link 50 30 10G 2026-06-01
+```
+
+When the expiry date hits, the link stops working automatically.
+
+</details>
+
+<details>
+<summary><b>Per-Person Keys (Recommended)</b></summary>
+
+```bash
+mtproxymax secret add alice
+mtproxymax secret add bob
+mtproxymax secret add charlie
+
+# Each person gets their own link — revoke individually
+mtproxymax secret setlimit alice ips 2
+mtproxymax secret setlimit bob ips 1
+mtproxymax secret setlimit charlie ips 3
+```
+
+</details>
+
+<details>
+<summary><b>Disable, Rotate, Remove</b></summary>
+
+```bash
+mtproxymax secret disable bob    # Temporarily cut off
+mtproxymax secret enable bob     # Restore access
+
+mtproxymax secret rotate alice   # New key, old link dies instantly
+
+mtproxymax secret remove bob     # Permanent removal
+```
+
+</details>
+
+---
+
+### 🤖 Telegram Bot (17 Commands)
+
+Full proxy management from your phone. Setup takes 60 seconds:
+
+```bash
+mtproxymax telegram setup
+```
+
+| Command | Description |
+|---------|-------------|
+| `/mp_status` | Proxy status, uptime, connections |
+| `/mp_secrets` | List all users with active connections |
+| `/mp_link` | Get proxy details + QR code image |
+| `/mp_add <label>` | Add new user |
+| `/mp_remove <label>` | Delete user |
+| `/mp_rotate <label>` | Generate new key for user |
+| `/mp_enable <label>` | Re-enable disabled user |
+| `/mp_disable <label>` | Temporarily disable user |
+| `/mp_limits` | Show all user limits |
+| `/mp_setlimit` | Set user limits |
+| `/mp_traffic` | Per-user traffic breakdown |
+| `/mp_upstreams` | List proxy chains |
+| `/mp_health` | Run diagnostics |
+| `/mp_restart` | Restart proxy |
+| `/mp_update` | Check for updates |
+| `/mp_help` | Show all commands |
+
+**Automatic alerts:**
+- 🔴 Proxy down → instant notification + auto-restart attempt
+- 🟢 Proxy started → sends connection details + QR codes
+- 📊 Periodic traffic reports at your chosen interval
+
+---
+
+### 🔗 Proxy Chaining (Upstream Routing)
+
+Route traffic through intermediate servers:
+
+```bash
+# Route 20% through Cloudflare WARP
+mtproxymax upstream add warp socks5 127.0.0.1:40000 - - 20
+
+# Route through a backup VPS
+mtproxymax upstream add backup socks5 203.0.113.50:1080 user pass 80
+
+# Hostnames are supported (resolved by the engine)
+mtproxymax upstream add remote socks5 my-proxy.example.com:1080 user pass 50
+```
+
+Supports **SOCKS5** (with auth), **SOCKS4**, and **direct** routing with weight-based load balancing. Addresses can be IPs or hostnames.
+
+---
+
+### 📊 Real-Time Traffic Monitoring
+
+Prometheus metrics give you real per-user stats:
+
+```bash
+mtproxymax traffic       # Per-user breakdown
+mtproxymax status        # Overview with connections count
+```
+
+- Bytes uploaded/downloaded per user
+- Active connections per user
+- Cumulative tracking across restarts
+
+---
+
+### 🌍 Geo-Blocking
+
+```bash
+mtproxymax geoblock add ir    # Block Iran
+mtproxymax geoblock add cn    # Block China
+mtproxymax geoblock list      # See blocked countries
+```
+
+IP-level CIDR blocklists enforced via iptables — traffic is dropped before reaching the proxy.
+
+---
+
+### 💰 Ad-Tag Monetization
+
+```bash
+mtproxymax adtag set <hex_from_MTProxyBot>
+```
+
+Get your ad-tag from [@MTProxyBot](https://t.me/MTProxyBot). Users see a pinned channel — you earn from the proxy.
+
+---
+
+### ⚙️ Engine Management
+
+```bash
+mtproxymax engine status              # Current engine version
+mtproxymax engine rebuild             # Force rebuild engine image
+mtproxymax rebuild                    # Force rebuild from source
+```
+
+Engine updates are delivered through `mtproxymax update`. Pre-built multi-arch Docker images (amd64 + arm64) are pulled automatically. Source compilation is the automatic fallback.
+
+---
+
+## 📊 Comparison
+
+### MTProxyMax vs Other Solutions
+
+| Feature | **MTProxyMax** | **mtg v2** (Go) | **Official MTProxy** (C) | **Bash Installers** |
+|---------|:-:|:-:|:-:|:-:|
+| **Engine** | telemt 3.x (Rust) | mtg (Go) | MTProxy (C) | Various |
+| **FakeTLS** | ✅ | ✅ | ❌ (needs patches) | Varies |
+| **Traffic Masking** | ✅ | ✅ | ❌ | ❌ |
+| **Multi-User Secrets** | ✅ (unlimited) | ❌ (1 secret) | Multi-secret | Usually 1 |
+| **Per-User Limits** | ✅ (conns, IPs, quota, expiry) | ❌ | ❌ | ❌ |
+| **Per-User Traffic Stats** | ✅ (Prometheus) | ❌ | ❌ | ❌ |
+| **Telegram Bot** | ✅ (17 commands) | ❌ | ❌ | ❌ |
+| **Interactive TUI** | ✅ | ❌ | ❌ | ❌ |
+| **Proxy Chaining** | ✅ (SOCKS5/4, weighted) | ✅ (SOCKS5) | ❌ | ❌ |
+| **Geo-Blocking** | ✅ | IP allowlist/blocklist | ❌ | ❌ |
+| **Ad-Tag Support** | ✅ | ❌ (removed in v2) | ✅ | Varies |
+| **QR Code Generation** | ✅ | ❌ | ❌ | Some |
+| **Auto-Recovery** | ✅ (with alerts) | ❌ | ❌ | ❌ |
+| **Auto-Update** | ✅ | ❌ | ❌ | ❌ |
+| **Docker** | ✅ (multi-arch) | ✅ | ❌ | Varies |
+| **User Expiry Dates** | ✅ | ❌ | ❌ | ❌ |
+| **Bandwidth Quotas** | ✅ | ❌ | ❌ | ❌ |
+| **Device Limits** | ✅ | ❌ | ❌ | ❌ |
+| **Active Development** | ✅ | ✅ | Abandoned | Varies |
+
+<details>
+<summary><b>Why Not mtg?</b></summary>
+
+[mtg](https://github.com/9seconds/mtg) is solid and minimal — by design. It's **"highly opinionated"** and intentionally barebones. Fine for a single-user fire-and-forget proxy.
+
+But mtg v2 dropped ad-tag support, only supports one secret, has no user limits, no management interface, and no auto-recovery.
+
+</details>
+
+<details>
+<summary><b>Why Not the Official MTProxy?</b></summary>
+
+[Telegram's official MTProxy](https://github.com/TelegramMessenger/MTProxy) (C implementation) was **last updated in 2019**. No FakeTLS, no traffic masking, no per-user controls, manual compilation, no Docker.
+
+</details>
+
+<details>
+<summary><b>Why Not a Simple Bash Installer?</b></summary>
+
+Scripts like MTProtoProxyInstaller install a proxy and give you a link. That's it. No user management, no monitoring, no bot, no updates, no recovery.
+
+MTProxyMax is not just an installer — it's a **management platform** that happens to install itself.
+
+</details>
+
+---
+
+## 🏗️ Architecture
+
+```
+Telegram Client
+      │
+      ▼
+┌─────────────────────────┐
+│  Your Server (port 443) │
+│  ┌───────────────────┐  │
+│  │  Docker Container  │  │
+│  │  ┌─────────────┐  │  │
+│  │  │   telemt     │  │  │  ← Rust/Tokio engine
+│  │  │  (FakeTLS)   │  │  │
+│  │  └──────┬──────┘  │  │
+│  └─────────┼─────────┘  │
+│            │             │
+│     ┌──────┴──────┐     │
+│     ▼             ▼     │
+│  Direct      SOCKS5     │  ← Upstream routing
+│  routing     chaining   │
+└─────────┬───────────────┘
+          │
+          ▼
+   Telegram Servers
+```
+
+| Component | Role |
+|-----------|------|
+| **mtproxymax.sh** | Single bash script: CLI, TUI, config manager |
+| **telemt** | Rust MTProto engine running inside Docker |
+| **Telegram bot service** | Independent systemd service polling Bot API |
+| **Prometheus endpoint** | `/metrics` on port 9090 (localhost only) |
+
+---
+
+## 📖 CLI Reference
+
+<details>
+<summary><b>Proxy Management</b></summary>
+
+```bash
+mtproxymax install              # Run installation wizard
+mtproxymax uninstall            # Remove everything
+mtproxymax start                # Start proxy
+mtproxymax stop                 # Stop proxy
+mtproxymax restart              # Restart proxy
+mtproxymax status               # Show proxy status
+mtproxymax menu                 # Open interactive TUI
+```
+
+</details>
+
+<details>
+<summary><b>User Secrets</b></summary>
+
+```bash
+mtproxymax secret add <label>           # Add user
+mtproxymax secret remove <label>        # Remove user
+mtproxymax secret list                  # List all users
+mtproxymax secret rotate <label>        # New key, same label
+mtproxymax secret enable <label>        # Re-enable user
+mtproxymax secret disable <label>       # Temporarily disable
+mtproxymax secret link [label]          # Show proxy link
+mtproxymax secret qr [label]            # Show QR code
+mtproxymax secret setlimit <label> <type> <value>  # Set individual limit
+mtproxymax secret setlimits <label> <conns> <ips> <quota> [expires]  # Set all limits
+```
+
+</details>
+
+<details>
+<summary><b>Configuration</b></summary>
+
+```bash
+mtproxymax port [get|<number>]          # Get/set proxy port
+mtproxymax ip [get|auto|<address>]      # Get/set custom IP for proxy links
+mtproxymax domain [get|clear|<host>]    # Get/set FakeTLS domain
+mtproxymax adtag set <hex>              # Set ad-tag
+mtproxymax adtag remove                 # Remove ad-tag
+```
+
+</details>
+
+<details>
+<summary><b>Security & Routing</b></summary>
+
+```bash
+mtproxymax geoblock add <CC>            # Block country
+mtproxymax geoblock remove <CC>         # Unblock country
+mtproxymax geoblock list                # List blocked countries
+mtproxymax upstream list                # List upstreams
+mtproxymax upstream add <name> <type> <host:port> [user] [pass] [weight]
+mtproxymax upstream remove <name>       # Remove upstream
+mtproxymax upstream test <name>         # Test connectivity
+```
+
+</details>
+
+<details>
+<summary><b>Monitoring</b></summary>
+
+```bash
+mtproxymax traffic                      # Per-user traffic breakdown
+mtproxymax logs                         # Stream live logs
+mtproxymax health                       # Run diagnostics
+```
+
+</details>
+
+<details>
+<summary><b>Engine & Updates</b></summary>
+
+```bash
+mtproxymax engine status                # Show current engine version
+mtproxymax engine rebuild               # Force rebuild engine image
+mtproxymax rebuild                      # Force rebuild from source
+mtproxymax update                       # Check for script + engine updates
+```
+
+</details>
+
+<details>
+<summary><b>Telegram Bot</b></summary>
+
+```bash
+mtproxymax telegram setup               # Interactive bot setup
+mtproxymax telegram status              # Show bot status
+mtproxymax telegram test                # Send test message
+mtproxymax telegram disable             # Disable bot
+mtproxymax telegram remove              # Remove bot completely
+```
+
+</details>
+
+---
+
+## 💻 System Requirements
+
+| Requirement | Details |
+|-------------|---------|
+| **OS** | Ubuntu, Debian, CentOS, RHEL, Fedora, Rocky, AlmaLinux, Alpine |
+| **Docker** | Auto-installed if not present |
+| **RAM** | 256MB minimum |
+| **Access** | Root required |
+| **Bash** | 4.2+ |
+
+---
+
+## 📁 Configuration Files
+
+| File | Purpose |
+|------|---------|
+| `/opt/mtproxymax/settings.conf` | Proxy settings (port, domain, limits) |
+| `/opt/mtproxymax/secrets.conf` | User keys, limits, expiry dates |
+| `/opt/mtproxymax/upstreams.conf` | Upstream routing rules |
+| `/opt/mtproxymax/mtproxy/config.toml` | Generated telemt engine config |
+
+---
+
+## 📋 Changelog
+
+### v1.2.0 — Engine v3.0.7 + Custom IP
+
+**Engine Upgrade (v3.0.4 → v3.0.7):**
+
+- **Fake TLS V2** — Complete rewrite of the TLS front. Handshakes now mirror real TLS 1.3 sessions with per-domain profiles, dynamic certificate lengths, and realistic record fragmentation. Significantly harder to fingerprint via DPI
+- **ME Pool V2** — Middle-end connections now use keepalive padding frames, staggered warmup, and exponential backoff reconnects for better stability under load
+- **Dynamic config reload** — Engine picks up config.toml changes without a restart
+- **SOCKS proxy hostname support** — Upstream SOCKS4/SOCKS5 proxies now accept hostnames in addition to IPs
+- **Frame size fixes** — Resolved "frame too large" errors on middle-end connections
+- **Extended handshake timeout** — `client_handshake` raised from 15s to 30s for slow networks
+
+**New Features:**
+
+- **Custom IP** — Set a custom IP for proxy links when behind NAT, CDN, or multi-IP setups. The proxy still binds to all interfaces — this only affects link/QR generation
+  ```bash
+  mtproxymax ip 203.0.113.50    # Set custom IP
+  mtproxymax ip auto             # Reset to auto-detect
+  ```
+  Also available in the setup wizard and TUI settings menu
+
+**Performance:**
+
+- **LTO builds** — Engine compiled with Link-Time Optimization (`LTO=true`, `codegen-units=1`) for ~10-20% faster throughput
+- **No default resource caps** — Docker CPU/memory limits now default to unlimited instead of 1 core / 256MB
+
+### v1.1.0 — Per-User Limits + Telegram Bot
+
+- Per-user connection, IP, quota, and expiry limits
+- Telegram bot with 17 commands for remote management
+- Proxy chaining via SOCKS5/SOCKS4 upstreams
+- Geo-blocking with CIDR blocklists
+- Auto-recovery with Telegram alerts
+
+### v1.0.0 — Initial Release
+
+- Full MTProto proxy management with telemt 3.x Rust engine
+- Interactive TUI + complete CLI
+- Multi-user secret management with QR codes
+- FakeTLS obfuscation with traffic masking
+- Prometheus metrics endpoint
+- Auto-update system
+
+---
+
+## 🙏 Credits
+
+Built on top of **telemt** — a high-performance MTProto proxy engine written in Rust/Tokio. All proxy protocol handling, FakeTLS, traffic masking, and per-user enforcement is powered by telemt.
+
+---
+
+## 📄 License
+
+MIT License — see [LICENSE](LICENSE) for details.
+
+Copyright (c) 2026 SamNet Technologies
--- a/install.sh
+++ b/install.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# MTProxyMax Quick Installer — SamNet Technologies
+# Usage: curl -sL https://git.samnet.dev/SamNet-dev/MTProxyMax/raw/branch/main/install.sh | sudo bash
+set -e
+SCRIPT_URL="https://git.samnet.dev/SamNet-dev/MTProxyMax/raw/branch/main/mtproxymax.sh"
+if [ "$(id -u)" -ne 0 ]; then echo "Run as root: curl -sL $SCRIPT_URL | sudo bash" >&2; exit 1; fi
+curl -fsSL "$SCRIPT_URL" -o /tmp/mtproxymax.sh && bash /tmp/mtproxymax.sh install && rm -f /tmp/mtproxymax.sh
--- a/main.png
+++ b/main.png
--- a/mtproxymax.sh
+++ b/mtproxymax.sh