This repository is the `luci-app-openclaw` package for OpenWrt routers, providing a complete web UI (via LuCI) and command-line management surface for the OpenClaw AI gateway. The system handles installation and lifecycle of a Node.js runtime and the OpenClaw npm package, configures AI model and messaging channel settings (Telegram, WeChat, etc.), manages device pairing approvals, offers an interactive terminal (xterm.js) via WebSocket, and supports backup/restore with atomic writes. The architecture is a monolithic OpenWrt plugin that integrates with procd for service management, UCI for configuration, and relies on external Node.js binaries plus the OpenClaw gateway software. The codebase exhibits strong engineering practices: a comprehensive contract-test suite with mutation testing, atomic configuration writes with pre-write backups, CSRF protection on all state-changing endpoints, a shell/JS menu engine for interactive configuration, and an upgrade state machine with rollback. It is actively maintained with frequent adjustments to upstream OpenClaw versions and security hardening.
This repository is a DPI bypass toolkit that intercepts and manipulates network packets to evade Deep Packet Inspection systems. It uses a modular architecture with a core daemon (nfqws2/dvtws2/winws2) that processes packets via NFQUEUE (Linux), divert sockets (*BSD), or WinDivert (Windows/Cygwin). Packet manipulation logic is implemented in Lua scripts, allowing flexible obfuscation strategies like packet splitting, reordering, and fake packet generation. The system includes automatic IP/host list management from external sources (antizapret, reestr), connection tracking for flow state, and cross-platform service integration. Key entry points are the main daemon, installation scripts, and list management utilities. Data flow involves packet interception → dissection → profile-based Lua processing → verdict (PASS/MODIFY/DROP) → reinjection. External dependencies include kernel interfaces (netfilter/WinDivert), Lua, zlib, and shell utilities for list updates.
This is the main OpenWrt build system and firmware distribution repository. It is not a single application but a complete, cross-compiling build system for producing embedded Linux firmware images targeting a vast array of routers, access points, and other network-attached devices. The repository consists of a top-level Makefile, a package directory tree (kernel modules, userspace utilities, libraries, firmware blobs), a kconfig-based configuration system, kernel patch sets, and numerous build helper scripts. In production, users clone this repo, run `make menuconfig` to select target hardware and packages, then `make` to produce a flashable firmware image (e.g., sysupgrade or factory image). The primary data flow involves downloading upstream source tarballs, applying OpenWrt-specific patches, compiling packages and the Linux kernel using a custom toolchain, and assembling the firmware image via mtd-utils and image generation scripts. External dependencies include the Linux kernel source, GNU toolchain (gcc, binutils, musl/glibc), and hundreds of upstream projects (hostapd, dnsmasq, openssl, etc.). The architecture is a monolithic build system with modular package definitions, enabling high customization through a kconfig frontend. While the build system is the core, the repo also contains many small userspace tools (mtd, swconfig, procd, netifd, uci) that run on the target device.
OpenClash is an OpenWrt/LuCI application that turns a router's admin interface into a full Clash/Mihomo proxy management system. The production code is mostly Lua CBI/controller modules, view templates with embedded JavaScript, and shell/Ruby orchestration scripts. It manages subscription downloads, YAML config generation and overwrite, core binary updates, GeoIP/GeoSite/China-route database updates, DNS/firewall integration, streaming-unlock probe and selection, and optional OIX managed-service integration. It also bundles the MetaCubeXD and zashboard single-page dashboards for live proxy monitoring and connection inspection. Architecturally, the project is an OpenWrt package: UCI configuration, an init.d service, and watchdog/procd lifecycle management. The LuCI controller exposes around 80 JSON/AJAX actions and uses low-level nixio fork/poll/pipe helpers for streaming subprocess output. The backend repeatedly combines shell scripts with Ruby-based YAML parsing and mutation to handle Clash configuration. External dependencies are significant: GitHub releases/CDNs for core and GEO data, subconverter services, the OIX API, and several IP-info services. Hardcoded URLs, vendored minified dashboard bundles, and multi-language shell/Ruby/Lua/C tooling are the main technical-drift risks. This is not a data-research repository; the data handled is operational proxy/node/routing state rather than analyzable datasets. No automated test suite is apparent in the tree; quality comes from defensive shell patterns (flock locks, ETag caching, retry loops) and feature depth rather than automated verification. The most reusable pieces are YAML.rb's merge/encryption layer, the server_url share-link parser widget, and the controller's streaming subprocess helpers.
Podkop is an OpenWrt package for traffic routing using sing-box as the proxy core. It provides a LuCI web interface (TypeScript frontend compiled to JavaScript) with tabs for Settings, Sections (proxy/VPN/block/exclusion), Dashboard (real-time traffic via Clash API WebSocket), and Diagnostic (checks for DNS, sing-box, nftables, FakeIP). The backend consists of shell scripts: /usr/bin/podkop (main entry), /etc/init.d/podkop (procd init), and libraries in /usr/lib/podkop/ (constants.sh, nft.sh, helpers.sh, sing_box_config_manager.sh, etc.). It uses nftables for traffic marking and TPROXY, dnsmasq for DNS hijacking with FakeIP, and downloads community domain/subnet lists from GitHub. It supports proxy protocols: VLESS, Shadowsocks, Trojan, SOCKS, Hysteria2. The architecture is monolithic: the frontend communicates with the backend via shell commands (exec) and WebSocket to the Clash API. The backend manages sing-box configuration, nftables rules, and list updates via cron. Key entry points include install.sh (installation), /usr/bin/podkop (service management), and the LuCI view files. External dependencies include sing-box, jq, curl, nft, coreutils-base64, bind-dig, and the diagnostic endpoints (ip.podkop.fyi, fakeip.podkop.fyi). The system is in beta, with breaking changes possible; users are advised to clear LuCI cache on updates. The codebase demonstrates solid engineering with modular shell libraries, a well-structured TypeScript frontend with unit tests for validators, and CI/CD pipelines. However, it has some drift risks: hardcoded version requirements, compiled JS committed to the repository, and reliance on external services. The frontend includes reusable components such as a reactive store service, WebSocket manager, and composable validators.
PassWall is a LuCI application for OpenWrt routers that provides a unified management interface and runtime orchestration for proxy/VPN clients. In production it runs as a daemon-managed transparent proxy: it generates per-core JSON configurations for xray, sing-box, shadowsocks-rust, SSR, hysteria2, naiveproxy, and other engines; builds iptables/nftables transparent-proxy rules; integrates DNS-level routing through dnsmasq, smartdns, chinadns-ng, or dns2socks; and exposes a full web UI for node management, subscriptions, ACLs, shunt rules, health checks, load balancing via HAProxy, and server-side inbound configuration. The service is configured through UCI (`/etc/config/passwall`), with shell scripts as the main runtime dispatchers and Lua modules as the configuration-generation and LuCI-controller layer.
This repository provides a transparent proxy package for OpenWrt using Mihomo (a clash-compatible rule-based proxy core) as the backend. It is a full LuCI application that allows users to configure proxy modes (redirect, TPROXY, TUN), manage subscriptions, define access control rules, and monitor logs through a web interface. The system is designed for OpenWrt ≥24.10 with firewall4 (nftables) and kernel ≥5.13. The architecture consists of three OpenWrt packages: `nikki` (main service and scripts), `mihomo-meta` (stable core), and `mihomo-alpha` (alpha variant). The service is managed via procd init script (`nikki.init`), which handles starting/stopping Mihomo, setting up routing rules and nftables tables, and scheduling tasks. Configuration is stored in UCI (OpenWrt's standard configuration system) and processed through a pipeline: UCI options → `mixin.uc` (ucode script) generates a JSON overlay → `yq` merges it with a base profile → final Mihomo config. Traffic interception rules are generated dynamically from a utpl template (`hijack.ut`) that produces nftables rulesets. Key entry points include the LuCI views (`app.js`, `profile.js`, `mixin.js`, `proxy.js`, `editor.js`, `log.js`) for web-based management, the init script for service lifecycle, and shell scripts for installation/upgrade. External dependencies are Mihomo core, `yq` for YAML processing, and standard OpenWrt tools (procd, nftables, ucode). The repository also includes a large hardcoded nftables set of Chinese IP prefixes (`geoip_cn.nft`) for bypassing mainland China traffic.
This repository is the OpenWrt packages feed: a collection of roughly 5,000 package build recipes, patches, init scripts, UCI defaults, netifd protocol handlers, and small utility programs that extend the OpenWrt embedded Linux distribution. It is not a standalone application; it is a software distribution layer consumed by OpenWrt's feed mechanism. Each package directory contains a Makefile that wraps an upstream project (download, patch, cross-compile, install) plus OpenWrt-specific runtime glue such as /etc/init.d scripts, configuration files, and ubus/rpcd plugins. It also contains language build helpers for Python, Go, Rust, Perl, and Lua packages, plus a shared CI/test framework.
nfqws-keenetic is a distribution and packaging repository that delivers the `nfqws` DPI-bypass utility (from the zapret project) as installable packages for embedded routers — primarily Zyxel Keenetic/Netcraze devices running Entware, plus OpenWRT. In production it functions as a service installer: post-install scripts detect the WAN interface and IPv6 availability, write a tuned nfqws.conf, install the correct architecture-specific nfqws binary, and register an init script that programs iptables/ip6tables POSTROUTING NFQUEUE rules for TCP/QUIC/UDP ports and manages the daemon lifecycle. The traffic-modifying logic itself lives in the upstream nfqws binary; this repo is the glue: packaging, configuration, firewall orchestration, and domain/IP lists (user.list, auto.list, exclude.list, ipset lists) for targeted DPI evasion. Architecturally it is a Makefile-driven build system (packages.mk, repository.mk) that downloads the latest zapret release binaries from GitHub at build time, cross-packages them into per-arch .ipk files (mipsel, mips, aarch64, and a multi-arch 'all' variant), and assembles an opkg/apk repository published to GitHub Pages via a GitHub Actions pipeline. The service layer is split into reusable POSIX-shell fragments: etc/init.d/common holds idempotent firewall rule management, kernel-module autoloading, runtime config generation, and validation; thin platform wrappers adapt it to Entware (S51nfqws) and OpenWRT (procd). A Keenetic netfilter hook (etc/ndm/netfilter.d/100-nfqws.sh) re-applies firewall rules whenever NDM regenerates them. Important maintenance truth: the README explicitly states the project no longer receives updates and all new features will appear in nfqws2-keenetic; this repo is the legacy v1 line (tag v2.11.4). An agent searching for an actively developed solution should evaluate the successor first, but the code that exists is well-crafted for its niche — config-versioned package migrations, layered architecture auto-detection in a single multi-arch package, and careful iptables rule idempotency. Technical drift is moderate: the release workflow relies on deprecated GitHub Actions (create-release v1, upload-release-asset v1), while the shell and packaging code targets stable router interfaces.
This is a LuCI application package for OpenWrt routers that provides a full web-based management interface for Clash/Mihomo proxy services. It handles the complete proxy lifecycle: service management via procd, transparent proxy setup (TPROXY/TUN/MIXED modes), DNS manipulation, firewall rule generation via nftables/iptables, subscription management, and a real-time log viewer. The package installs to /opt/clash/ and integrates deeply with OpenWrt's hotplug, UCI, and LuCI systems. A separate Vue-based SPA dashboard (zashboard) is bundled for advanced features like Tailscale management, network diagnostics (bandwidth tests, STUN NAT detection), and an embedded SSH terminal. The architecture is a classic OpenWrt package: shell scripts for service and firewall management (/etc/init.d/clash, /opt/clash/bin/clash-rules), LuCI JavaScript views for the admin UI (config, settings, rulesets, log), hotplug scripts for network events, and a vendored Ace editor for YAML editing. The firewall engine is the most substantial component — roughly 1400 lines of modular shell that generates nftables/iptables rules, manages subscription IP caches with locking, and auto-generates fake-IP whitelists from rule providers. The init script includes rollback logic that restores DNS/firewall state on failure, preventing bricked router connectivity. The repository is explicitly legacy: the README states active development has moved to SSClash-Go (a single static binary with built-in web UI). This repo receives bugfix maintenance only. Technical drift is medium — the vendored Ace editor is an old version (1.5.0), the shell scripts use fragile heuristics for YAML transformation, GitHub API calls for kernel downloads lack caching, and the dual configuration (config.yaml plus /opt/clash/settings) can confuse users. However, the CI pipeline is maintained and the package builds for current OpenWrt versions (both ipk and apk formats). For reuse, the most valuable components are the modular firewall engine pattern (nft/iptables abstraction with idempotent rule generation), the procd init script with rollback logic, and the LuCI view utilities (chunked file writing, service polling). These could be extracted for other OpenWrt proxy/VPN services with minimal modification. The repo serves as a solid reference for OpenWrt package structure, LuCI app development, and transparent proxy integration, though new projects should target the successor SSClash-Go instead.
Gargoyle is a third-party router firmware distribution based on OpenWrt/LEDE. It provides a comprehensive web-based administration interface with features such as bandwidth monitoring, QoS, VPN (OpenVPN, WireGuard, Tor), dynamic DNS, ad blocking, web monitoring, and a plugin system for extensibility. The codebase is a large collection of C utilities (custom netfilter match modules, a package manager 'gpkg', bandwidth accounting libraries, and a CGI framework built on a patched version of haserl), shell scripts for UCI configuration and firewall management, and JavaScript/CSS for the web UI. Internationalization is extensive with over a dozen language packs. The architecture is monolithic in the sense that all components are built as part of a firmware image, but modular at the package level. Key data flows involve kernel-level packet matching (via custom nftables/iptables modules) feeding user-space libraries (libiptbwctl/libnftbwctl) and shell scripts that expose bandwidth and status data through the web interface.
This repository is a collection of LuCI applications (luci-app-*) for OpenWrt/iStoreOS, providing web-based management UIs for Docker services, system monitoring (netdata), and third-party tools (OpenClaw AI gateway, Sunpanel, mymind). It operates as an OpenWrt package feed: GitHub Actions workflows build IPK packages from the source tree, and a Go CLI tool (`forkapp`) clones and uploads LuCI apps to routers. The target platform is iStoreOS, with feeds configured from nas-packages and istore sources.
This repository is a custom OpenWrt firmware distribution named 'Kwrt', based on the openwrt-25.12 stable branch and heavily optimized for Chinese domestic use. It provides a multi-target build overlay system with per-device configuration, patches, and customization scripts for a wide range of router and SBC platforms (x86_64, Rockchip, MediaTek, Qualcomm IPQ, Broadcom, Amlogic, etc.). The core functionality is to produce ready-to-flash firmware images with Chinese localization, pre-configured WiFi, custom package feeds, and additional device support not present in upstream OpenWrt. The build process is fully automated via GitHub Actions, which triggers on repository dispatch events, builds firmware for all targets, uploads artifacts to release pages and cloud storage, and sends notifications via Telegram. The repository also includes an online firmware customization service at openwrt.ai and a self-hosted package repository at dl.openwrt.ai. While the codebase is functional and well-organized for its purpose, it exhibits hobbyist maintenance patterns such as brittle sed-based patching, hardcoded local paths, binary blobs without provenance, and incomplete patch files, which limit its reusability and long-term maintainability.
This repository provides a GitHub Actions-based continuous integration pipeline for building custom OpenWrt firmware specifically for the Xiaomi AX3000T router. It contains a pre-configured build configuration (`.config`), custom feed scripts (`diy-part1.sh`, `diy-part2.sh`), and a comprehensive workflow file that orchestrates the entire build process: cloning the LEDE source tree, applying customizations (including passwall2, ddns-go, Argon theme, and UA3F), and compiling the firmware. The repository also includes detailed documentation for unlocking SSH on the stock firmware, flashing the custom build, and reverting to the official Xiaomi firmware. While the repo is not a traditional software application, it serves as a build configuration and automation project for embedded Linux firmware development. The codebase is tightly coupled to the specific hardware and build process, offering no reusable software components outside of the OpenWrt build context.
This repository is a heavily forked and customized version of the OpenWrt/LEDE build system, primarily focused on producing router firmware images with extensive proprietary MediaTek (Ralink) WiFi drivers, Lantiq DSL support, Quantenna firmware, and various custom utilities. The codebase is dominated by low-level kernel drivers for Wi-Fi chipsets (mt7615d, mt7603e, mt7612e) with thousands of lines of register definitions, hardware abstraction layers, and protocol state machines (802.11k/r/v, SAE, DFS, beamforming). It includes user-space daemons for embedded authentication (ead with tinysrp), network services (GRE, DHCPv6, WWAN), and firmware image tools (oseama, nvram, bcm4908img). The build system follows standard OpenWrt structure with top-level Makefile, package feeds, and include directives. The repository is a monolithic build system producing embedded Linux firmware, not a library or microservices application. It has high technical drift due to reliance on out-of-tree kernel modules, deprecated APIs, and aging cryptographic code. Reusable components are scarce but include standalone shell scripts for calibration data extraction and a self-contained SRP authentication library.
This repository is a collection of GitHub Actions workflows for automated building of OpenWrt firmware images. It does not contain application code; instead, it orchestrates the compilation of OpenWrt from various upstream sources (Lean, Lienol, immortalwrt) with custom configurations, patches, and package feeds. The workflows handle cloning source code, applying customizations, compiling firmware, and uploading artifacts to Cloudflare R2, GitHub Releases, and Docker Hub. The repository is essentially a CI/CD configuration hub for producing customized OpenWrt images for multiple targets including x86, NanoPi R4S/R5S/R6S, and others. There are no reusable software components; the value lies in the automation patterns for embedded firmware builds.