$ show Openwrt-Passwall/openwrt-passwall
PassWall is a LuCI application for OpenWrt routers that provides a unified management interface and runtime orchestration for proxy/VPN clients. In production it runs as a daemon-managed transparent proxy: it generates per-core JSON configurations for xray, sing-box, shadowsocks-rust, SSR, hysteria2, naiveproxy, and other engines; builds iptables/nftables transparent-proxy rules; integrates DNS-level routing through dnsmasq, smartdns, chinadns-ng, or dns2socks; and exposes a full web UI for node management, subscriptions, ACLs, shunt rules, health checks, load balancing via HAProxy, and server-side inbound configuration. The service is configured through UCI (`/etc/config/passwall`), with shell scripts as the main runtime dispatchers and Lua modules as the configuration-generation and LuCI-controller layer.
The LLM identified 3 files worth highlighting for reuse:
Shared Lua helper library that provides encoding/decoding (base64, URL), HTTP fetch wrappers with direct/proxy/auto variants, UCI read/write helpers with type coercion, semantic version comparison, UUID generation, domain resolution, and TLS certificate fingerprint retrieval. Though tuned for PassWall, the majority of functions are self-contained and can be lifted into another OpenWrt/LuCI application that needs robust config access, network utilities, or API building blocks.
POSIX shell helper library used by all PassWall init and runtime scripts. It provides guarded process launching (ln_run), typed UCI config getters, dynamic port allocation with collision checks, DNS normalization, and common service-management utilities. These shell functions are written as small, composable routines that could be reused by any OpenWrt package requiring safe file/process/config handling in BusyBox-compatible shell.
Parses Clash-format subscription content and converts it into PassWall's normalized node representation. It handles multiple protocol proxy entries, extracts group and server fields, and normalizes legacy/variant field names. The conversion logic is decoupled from PassWall-specific runtime concerns and can be reused by any tool that needs to ingest Clash YAML subscriptions and emit a structured proxy node list.