$ show zerolabnet/SSClash
This is a LuCI application package for OpenWrt routers that provides a full web-based management interface for Clash/Mihomo proxy services. It handles the complete proxy lifecycle: service management via procd, transparent proxy setup (TPROXY/TUN/MIXED modes), DNS manipulation, firewall rule generation via nftables/iptables, subscription management, and a real-time log viewer. The package installs to /opt/clash/ and integrates deeply with OpenWrt's hotplug, UCI, and LuCI systems. A separate Vue-based SPA dashboard (zashboard) is bundled for advanced features like Tailscale management, network diagnostics (bandwidth tests, STUN NAT detection), and an embedded SSH terminal. The architecture is a classic OpenWrt package: shell scripts for service and firewall management (/etc/init.d/clash, /opt/clash/bin/clash-rules), LuCI JavaScript views for the admin UI (config, settings, rulesets, log), hotplug scripts for network events, and a vendored Ace editor for YAML editing. The firewall engine is the most substantial component — roughly 1400 lines of modular shell that generates nftables/iptables rules, manages subscription IP caches with locking, and auto-generates fake-IP whitelists from rule providers. The init script includes rollback logic that restores DNS/firewall state on failure, preventing bricked router connectivity. The repository is explicitly legacy: the README states active development has moved to SSClash-Go (a single static binary with built-in web UI). This repo receives bugfix maintenance only. Technical drift is medium — the vendored Ace editor is an old version (1.5.0), the shell scripts use fragile heuristics for YAML transformation, GitHub API calls for kernel downloads lack caching, and the dual configuration (config.yaml plus /opt/clash/settings) can confuse users. However, the CI pipeline is maintained and the package builds for current OpenWrt versions (both ipk and apk formats). For reuse, the most valuable components are the modular firewall engine pattern (nft/iptables abstraction with idempotent rule generation), the procd init script with rollback logic, and the LuCI view utilities (chunked file writing, service polling). These could be extracted for other OpenWrt proxy/VPN services with minimal modification. The repo serves as a solid reference for OpenWrt package structure, LuCI app development, and transparent proxy integration, though new projects should target the successor SSClash-Go instead.
The LLM identified 4 files worth highlighting for reuse:
Modular firewall/routing engine (~1400 lines) that generates nftables and iptables rules from a settings abstraction. Implements subscription IP caching with file locking, fake-IP whitelist auto-generation from rule providers, and policy routing for TPROXY/TUN modes. The separation of nft/iptables backends and idempotent rule generation makes this a reusable pattern for any OpenWrt proxy or VPN service needing transparent traffic redirection.
Procd-based init script with robust rollback logic: on service failure it restores DNS and firewall state, waits for boot dependencies, and triggers post-start callbacks. Demonstrates a clean service lifecycle pattern for OpenWrt daemons that modify system network state, with safety mechanisms that prevent bricking router connectivity.
Shared utility module for LuCI views implementing chunked base64 file writing for large configs (>32KB), configurable service status polling with timeout/interval, and error/log message formatting. The chunked write and polling patterns are generic and extractable for any LuCI app that needs to write large files or wait for service state transitions.
WAN interface hotplug hook that triggers proxy/rule provider updates via the Mihomo REST API without restarting the service. Demonstrates an event-driven pattern for keeping proxy subscriptions fresh on network state changes, using curl with secret-based auth against the local daemon API.