{"id":51633877,"url":"https://github.com/litvinovtd/qeli","last_synced_at":"2026-07-13T12:00:25.365Z","repository":{"id":366019289,"uuid":"1262230681","full_name":"litvinovtd/qeli","owner":"litvinovtd","description":"Self-hosted, censorship-resistant VPN with REALITY / anti-DPI obfuscation and post-quantum (X25519 + ML-KEM-768) crypto. Rust core + native Android/Windows/macOS clients. Works on networks with active DPI (Iran, China, Russia).","archived":false,"fork":false,"pushed_at":"2026-07-05T20:15:06.000Z","size":27523,"stargazers_count":172,"open_issues_count":19,"forks_count":6,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-07-05T20:15:15.348Z","etag":null,"topics":["android","anti-censorship","anti-dpi","censorship-circumvention","deep-packet-inspection","dpi-bypass","macos","ml-kem","obfuscation","post-quantum","quic","reality","rust","self-hosted","vpn","vpn-client","vpn-server","windows","wireguard-alternative","xray"],"latest_commit_sha":null,"homepage":"https://qeli.ru","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/litvinovtd.png","metadata":{"files":{"readme":"docs/README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-07T18:28:51.000Z","updated_at":"2026-07-04T09:51:18.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/litvinovtd/qeli","commit_stats":null,"previous_names":["litvinovtd/qeli"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/litvinovtd/qeli","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/litvinovtd%2Fqeli","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/litvinovtd%2Fqeli/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/litvinovtd%2Fqeli/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/litvinovtd%2Fqeli/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/litvinovtd","download_url":"https://codeload.github.com/litvinovtd/qeli/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/litvinovtd%2Fqeli/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35421716,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-13T02:00:06.543Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","anti-censorship","anti-dpi","censorship-circumvention","deep-packet-inspection","dpi-bypass","macos","ml-kem","obfuscation","post-quantum","quic","reality","rust","self-hosted","vpn","vpn-client","vpn-server","windows","wireguard-alternative","xray"],"created_at":"2026-07-13T12:00:17.462Z","updated_at":"2026-07-13T12:00:25.301Z","avatar_url":"https://github.com/litvinovtd.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Qeli — self-hosted anti-censorship VPN with REALITY / anti-DPI obfuscation\n\n**Qeli** — самостоятельно-хостируемый (self-hosted) VPN с современной криптографией\nи настраиваемой **обфускацией транспорта**, спроектированный для работы в сетях с\nактивной **DPI** (Deep Packet Inspection). Один Rust-движок протокола и нативные\nклиенты под **Android, Windows и macOS** на общем ядре через FFI; есть\nэкспериментальный клиент для роутеров **Keenetic** (клиент под **OpenWrt** — в разработке).\n\n**Qeli** is a **self-hosted, censorship-resistant VPN** with modern cryptography and\nconfigurable **transport obfuscation**, built to keep working on networks with active\n**Deep Packet Inspection (DPI)**. One Rust protocol engine plus native **Android /\nWindows / macOS** clients sharing a native core via FFI, plus an experimental\n**Keenetic** router client (an **OpenWrt** client is in development).\n\nКриптография · Cryptography: эфемерный **X25519** + post-quantum **ML-KEM-768**\n(гибридный handshake) · **ChaCha20-Poly1305** AEAD · **Argon2id** для паролей.\n\n## Статус · Status\n\n\u003e ⚠️ **Бета.** Все компоненты сейчас в бета-версиях и могут работать нестабильно.\n\u003e Стабильной считается линейка начиная с версии **1.0** — она выйдет после\n\u003e тестирования и сбора обратной связи от пользователей.\n\u003e\n\u003e ⚠️ **Beta.** All components are currently beta releases and may be unstable.\n\u003e The **1.0** line will be the first stable one — it will ship after testing and\n\u003e user feedback.\n\n## Возможности · Features\n\n- **Режимы обфускации (wire modes) · obfuscation/wire modes:** `plain`, `fake-tls`,\n  `obfs`, **`reality-tls` (REALITY)**, `quic` — выбираются на профиль, по TCP и UDP.\n- **REALITY (`reality-tls`):** настоящий TLS 1.3-handshake к реальному стороннему сайту\n  (cert-borrowing / TLS-camouflage) — трафик выглядит как обычный HTTPS к этому сайту,\n  устойчив к **active probing** и блокировке по SNI. A genuine TLS 1.3 handshake to a\n  real decoy site, so the connection is indistinguishable from ordinary HTTPS and\n  resists active probing \u0026 SNI-based blocking.\n- **Анти-DPI форма потока · traffic flow shaping:** cover-трафик в простое (Poisson) +\n  опциональный **stealth**-режим, чтобы поток не выглядел как «bulk-загрузка» для\n  статистического DPI.\n- **Post-quantum:** гибридный X25519 + **ML-KEM-768** во внутреннем handshake — защита\n  от «harvest-now, decrypt-later».\n- **Кроссплатформенные клиенты · cross-platform clients:** Android, Windows (WPF),\n  macOS (Avalonia), общий нативный core (Rust FFI) + экспериментальный Keenetic\n  (OpenWrt — в разработке: procd + UCI + LuCI).\n- **Self-hosted сервер · server:** Linux, `.deb`-пакет + systemd, **веб-панель**\n  администрирования, CLI, full-tunnel NAT, мульти-профиль (по профилю на режим/порт).\n- **Импорт в один шаг · one-tap import:** `qeli://`-ссылки и QR для телефонов.\n\n## Работает при активном DPI · Works under active DPI\n\nQeli создан для **устойчивости к цензуре** в сетях, где обычный VPN (WireGuard,\nOpenVPN, IKEv2) распознаётся и блокируется DPI — например в **Иране**, **Китае**\n(Great Firewall / GFW) и **России** (ТСПУ). Режим **REALITY** маскирует туннель под\nобычный HTTPS к легитимному сайту, а форма потока сбивает статистические эвристики DPI.\n\nQeli is designed for **censorship circumvention** on networks where ordinary VPN\nprotocols are fingerprinted and blocked by DPI — e.g. **Iran**, **China** (the Great\nFirewall / GFW) and **Russia** (TSPU). **REALITY** makes the tunnel look like normal\nHTTPS to a legitimate site, and traffic shaping defeats statistical DPI heuristics.\n\n\u003e По духу — самохостируемая альтернатива связке Xray/V2Ray/sing-box (REALITY/VLESS),\n\u003e но с собственным протоколом, нативными GUI-клиентами и post-quantum handshake.\n\u003e In spirit a self-hosted alternative to Xray / V2Ray / sing-box (REALITY/VLESS)\n\u003e setups, but with its own protocol, native GUI clients and a post-quantum handshake.\n\n## Быстрый старт · Quick start\n\n**Сервер за одну команду (спросит профиль + порт) · one-command server (asks profile + port):**\n\n```bash\n# на чистом Linux-сервере (Debian/Ubuntu), от root · on a clean Linux server, as root:\ncurl -fsSLO https://raw.githubusercontent.com/litvinovtd/qeli/main/install-reality-server.sh\nless install-reality-server.sh   # просмотрите перед запуском · review before running\nbash install-reality-server.sh\n```\n\n\u003e Скачиваем и запускаем отдельно (а не `curl … | bash`), чтобы скрипт можно было\n\u003e просмотреть до выполнения от root. Внутри установщик проверяет `.deb` по SHA256.\n\u003e Download-then-run (not `curl … | bash`) so the script can be reviewed before it runs\n\u003e as root; the installer itself verifies the `.deb` against SHA256.\n\nСкрипт ставит `.deb` из [Releases](https://github.com/litvinovtd/qeli/releases),\n**спрашивает профиль** (reality-tls по умолчанию или fake-tls) **и порт** (по умолчанию\n:443), пишет конфиг с full-tunnel NAT, создаёт пользователей и печатает готовые\n`qeli://`-ссылки. Для неинтерактивного запуска (или `curl … | bash`) задайте выбор\nзаранее: `QELI_PROFILE=reality-tls|fake-tls` и/или `QELI_PORT=\u003c1-65535\u003e`. Затем поставьте\nклиент из [Releases](https://github.com/litvinovtd/qeli/releases) и\nвставьте/отсканируйте ссылку. Подробный разбор «с нуля» (CLI + веб-панель) —\n[GETTING-STARTED.md](eng/GETTING-STARTED.md) · [GETTING-STARTED.md (рус)](ru/GETTING-STARTED.md).\n\nThe script installs the `.deb` from Releases, **asks for the profile** (reality-tls by\ndefault, or fake-tls) **and the listen port** (default :443), writes the config with\nfull-tunnel NAT, creates users and prints ready-to-use `qeli://` links. For a\nnon-interactive run (or `curl … | bash`) set the choice up front:\n`QELI_PROFILE=reality-tls|fake-tls` and/or `QELI_PORT=\u003c1-65535\u003e`. Then install a\nclient from Releases and paste/scan a link. Full from-scratch guide (CLI + web panel) is\nin [GETTING-STARTED.md](eng/GETTING-STARTED.md).\n\n## Документация · Documentation\n\n- 🇷🇺 **Русский** — [`docs/ru/README.md`](ru/README.md)\n- 🇬🇧 **English** — [`docs/eng/README.md`](eng/README.md)\n\n(Полная документация — конфигурация, дизайн, аудиты, бенчмарки, модель угроз — в\nсоответствующей локали. The full docs — configuration, design, audits, benchmarks,\nthreat model — live under each locale.)\n\n## License\n\nМонорепозиторий с **несколькими лицензиями по каталогам** · monorepo with\n**per-directory licences**:\n\n- ядро + сервер (`qeli/`) · core + server → **AGPL-3.0-only** ([LICENSE](../LICENSE))\n- клиенты (`qeli-android/`, `qeli-win/`, `qeli-mac/`) · clients → **MPL-2.0**\n\nПолная карта и нюансы (`libqeli`/AGPL) · full map and the `libqeli`/AGPL note —\n[LICENSING.md](../LICENSING.md). Вклады · contributing (DCO, без CLA) —\n[CONTRIBUTING.md](../CONTRIBUTING.md).\n\n---\n\n\u003csub\u003e**Keywords:** self-hosted VPN, anti-censorship VPN, censorship circumvention,\nanti-DPI, DPI bypass, deep packet inspection, REALITY, Reality TLS, TLS camouflage,\nSNI, active-probing resistant, traffic obfuscation, fake-TLS, obfs, QUIC VPN,\npost-quantum VPN, ML-KEM-768, X25519, ChaCha20-Poly1305, Rust VPN, Android VPN,\nWindows VPN, macOS VPN, Keenetic, WireGuard alternative, Xray / V2Ray / sing-box\nalternative, VPN for Iran, VPN for China / Great Firewall, VPN for Russia / TSPU.\u003c/sub\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flitvinovtd%2Fqeli","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flitvinovtd%2Fqeli","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flitvinovtd%2Fqeli/lists"}