MegaProxyServer

Provision and operate hardened HTTPS and SSH proxy servers with Ansible.

MegaProxyServer manages multiple Debian/Ubuntu hosts from one inventory, keeps proxy users global, issues and renews TLS certificates, supports SNI-routed HTTPS chains and exports ready-to-import client configurations for MegaProxy for Android, FoxyProxy and SuperProxy.

Documentation: English · Русский

Quick start

To configure the Debian/Ubuntu server you are logged into, run the interactive installer:

curl -fsSL https://raw.githubusercontent.com/andre487/MegaProxyServer/main/install.sh | sudo bash

It installs dependencies and starts the setup wizard. Keep your SSH session open and save the administrative key on your computer before confirming provisioning. See the English or Russian walkthrough.

Manage servers from another machine

Requirements: macOS or Linux, Python 3.12+, uv, OpenSSH, and a Debian or Ubuntu server reachable through a sudo-capable SSH account.

./mega-proxy inventory
./mega-proxy plan
./mega-proxy apply
./mega-proxy verify

For an existing inventory, pass --inventory PATH before the command. Generate client files and display credentials:

./mega-proxy configs
./mega-proxy summary

Inventory and generated exports contain secrets. Keep them private and do not commit them.

Connect with Android MegaProxy

Install the client using its installation guide, transfer .generated/configs/MegaProxy.json privately, and import it in the app. Select a profile, run Test, verify any SSH host-key prompt, then connect and approve Android VPN access.

The current server exporter produces JSON v7, accepted by the current Android v8 importer. Server-side SNI chains are exported as ordinary HTTPS profiles. The app also supports client-side HTTPS with Jump, which must currently be configured in the app. See the English or Russian guide for chain setup and reimport behavior.

Highlights

• HTTPS CONNECT proxy with TLS 1.2/1.3 and optional probe-resistant decoy responses
• ACME certificates for DNS names and public IP addresses, plus a self-signed fallback
• SNI-based HTTPS chains through independently selected entry and exit servers
• Restricted SSH forwarding accounts and dynamic SSH jump profiles
• Global HTTPS and SSH users, with safe removal across every managed host
• Inline Ansible Vault encryption that leaves non-secret inventory settings readable
• Idempotent provisioning and integration tests on Ubuntu and Debian

See inventory.example.yml and the English or Russian guide for all options.

Development

./mega-proxy check

This runs Ruff, pytest, Python byte-compilation and Ansible syntax checks with dependencies locked in uv.lock.

License

See LICENSE.