Sudoku 一键部署 & dash 管理面板

中文

一键安装

在 Linux 服务器（systemd 或 OpenRC/Alpine，amd64 / arm64）上以 root 运行：

curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && sudo bash /tmp/sudoku-dash.sh

全程只需一路回车：端口（默认随机）→ AEAD 加密方式（默认 chacha20-poly1305）→ ASCII 模式（默认 up_ascii_down_entropy）→ 是否启用 WARP（默认否）。其余（自定义表 custom_table 自动随机生成、packed 下行、HTTP Mask auto + 随机路径前缀、CF 风格回落页）都用默认值，不会提问。装完会直接给出 sudoku:// 分享链接。

安装后脚本会变成常驻的管理面板 sudoku-dash，随时启动：

sudo sudoku-dash

面板功能：

实时带宽：服务端 RX / TX 速率、曲线、累计与峰值、各客户端 IP 速率
资源占用：Sudoku 进程 CPU / 内存 / 连接数 / 线程 / FD，以及系统负载
用户管理：按用户显示在线状态、实时上下行速率、本月已用流量 / 额度；添加 / 限速 / 限流量 / 封禁 / 删除用户，为每个用户生成独立分享链接
版本管理：升级到最新 release、安装指定版本或预发布、失败自动回滚、手动回滚到备份
服务控制 / 设置：重启、停止、查看与跟随日志、改端口、开关 WARP、改公网地址

非交互环境（curl … | sudo bash、CI）会自动采用默认值，不弹任何提问。

Alpine / NAT 小鸡：Alpine 默认没有 curl 和 bash，先装一下（脚本会自己用 apk 补装 bash、python3、jq、openssl、iproute2、ca-certificates，服务以 OpenRC 方式注册，日志在 /var/log/<服务名>.log）：

apk add --no-cache curl bash && curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && bash /tmp/sudoku-dash.sh

NAT 机器只有映射好的那几个端口可用：向导里端口填映射到本机的端口（或 SUDOKU_PORT=…），分享链接里的地址用 SERVER_IP=<NAT 公网地址> 指定。

环境变量

全部可选，写在命令前即可，例如 sudo SUDOKU_PORT=8443 SUDOKU_WARP=true bash /tmp/sudoku-dash.sh。设置了某项，向导就不会再问它。

变量	默认值	含义
`SUDOKU_PORT`	随机 50001-65535	服务端监听端口（自定义端口用它）
`SUDOKU_AEAD`	`chacha20-poly1305`	加密方式：`chacha20-poly1305` / `aes-128-gcm` / `none`
`SUDOKU_ASCII`	`up_ascii_down_entropy`	ASCII 模式：`up_ascii_down_entropy` / `prefer_entropy` / `prefer_ascii` / `up_entropy_down_ascii`
`SUDOKU_WARP`	`false`	`true` = 所有代理流量经 Cloudflare WARP 出站（隐藏 VPS 出口 IP、解锁地区限制）。会改用 sudoku-sing-box 内核，旧名 `SUDOKU_WARP_GOOGLE` 仍可用
`SUDOKU_VERSION`	最新 release	指定安装的 Sudoku 版本 tag，如 `v0.5.1`
`SERVER_IP`	自动检测	写入分享链接的公网 IP 或域名
`SUDOKU_YES`	自动	`1` = 永不提问；无 TTY 时默认为 `1`
`SUDOKU_LANG`	跟随 `$LANG`	界面语言：`zh` / `en`
`SUDOKU_CLIENT_PORT`	`10233`	导出的客户端配置里本地代理端口
`SUDOKU_FALLBACK`	内置 CF 风格 500 页	可疑流量的回落地址 `host:port`；自定义后不再覆盖
`SUDOKU_CF_FALLBACK`	`true`	`false` = 不部署内置回落页，回落到 `127.0.0.1:80`
`SUDOKU_CF_FALLBACK_BIND` / `_PORT` / `_FALLBACK_PORT` / `_FORCE`	`127.0.0.1` / `10232` / `80` / `false`	内置回落页的监听地址、端口、备用端口、是否强制覆盖 `SUDOKU_FALLBACK`
`SUDOKU_HTTP_MASK`	`true`	HTTP Mask 开关
`SUDOKU_HTTP_MASK_MODE`	`auto`	`auto` / `stream` / `poll` / `legacy` / `ws`
`SUDOKU_HTTP_MASK_TLS`	`false`	HTTP Mask 是否走 TLS
`SUDOKU_HTTP_MASK_HOST`	空	覆盖 HTTP Mask 的 Host
`SUDOKU_HTTP_MASK_PATH_ROOT`	随机 6-10 位小写字母	单段路径前缀 `[A-Za-z0-9_-]+`
`SUDOKU_HTTP_MASK_MULTIPLEX`	`on`	`off` / `auto` / `on`
`SUDOKU_SUBSCRIPTION_PATH`	`/etc/sudoku/subscription.yaml`	本地生成的 Mihomo YAML 输出路径
`SUDOKU_SUBSCRIPTION_NODE_NAME`	`sudoku`	YAML 中的节点名
`SUDOKU_SUBSCRIPTION_TEMPLATE_URL`	内置模板	自定义 Mihomo 模板（需含 `rule-providers:`）
`SUDOKU_REPO`	`SUDOKU-ASCII/sudoku`	内核仓库

自定义端口

# 安装时
curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && sudo SUDOKU_PORT=8443 bash /tmp/sudoku-dash.sh
# 安装后：sudo sudoku-dash → 设置 → 修改端口（自动更新防火墙与服务；客户端需换用新链接）

WARP

# 安装时直接启用
curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && sudo SUDOKU_WARP=true bash /tmp/sudoku-dash.sh
# 安装后随时开关：sudo sudoku-dash → 设置 → 启用 / 关闭 WARP

用户管理说明

用户控制依赖内核的 users 白名单：当前 release（v0.5.1）会忽略该字段，需要 Sudoku ≥ 0.5.2（官方主线已合入、尚未发布），或启用 WARP 模式（自带的 sudoku-sing-box 已支持）。内核不支持时 dash 会明确提示，不会让你误以为限制已生效。
添加第一个用户时会把安装时的默认密钥自动加为 default 用户，避免现有客户端被锁出。
修改用户后需重启服务才生效（dash 会询问并代为重启）。
按用户的实时数据来自内核的 RESTful API（external_controller，Sudoku 主线新增，只读）。内核支持时（直连模式的 Sudoku 主线，或 WARP 模式的新版 sudoku-sing-box，后者走其 Clash API 的 /users，格式一致），安装 / 升级会自动写入 external_controller（仅监听 127.0.0.1 的随机端口）和随机 secret；对已安装的机器，打开 dash →「用户」会询问是否一键启用。启用后 dash 显示：
- 每个用户的 在线 / 空闲 / 已封禁 / 已超额 状态、连接数、实时下载 / 上传速率；
- 本月已用流量（线路字节，内核持久化到 config.usage.json，重启不丢，按服务器本地时间每月 1 日清零）、额度、剩余量、进度条与重置日期；
- 本次运行累计流量；总览与「实时带宽」页也会列出各用户速率。
额度（data，单位 GB，按 1 GB = 10⁹ 字节计）用完后内核会断开该用户现有连接并拒绝新连接；想提前清零某用户用量，停服务后删掉 config.usage.json 里对应条目即可。
WARP 模式同样支持：sudoku-sing-box 的用量与直连共用同一个 config.usage.json，两种模式来回切换用量不丢。该内核的 release tag 是原地覆盖重发的（tag 不变，二进制已更新），所以 sudo sudoku-dash --upgrade（或 dash →「版本管理」）会对比 GitHub 上的资产标识，发现新构建就刷新 sing-box，即使 Sudoku 版本没变。
不支持的情况：v0.5.1 release、或旧版 sudoku-sing-box 构建无实时数据，dash 只显示限速 / 额度 / 状态和日志统计的会话数，并在界面里说明原因；运行 sudo sudoku-dash --upgrade 即可刷新 sing-box。

升级 / 卸载

# 升级到最新 release（同时更新 dash）：
sudo sudoku-dash --upgrade
# 或在面板里：sudo sudoku-dash → 版本管理（可选版本、可回滚；新版本启动失败会自动回滚）

# 卸载（交互式会询问是否同时删除配置与密钥）：
sudo sudoku-dash --uninstall
# 脚本不在本机时：
curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh
sudo bash /tmp/sudoku-dash.sh --uninstall

其它命令：sudoku-dash status（纯文本状态）、sudoku-dash --help。

dash 同名命令仅在系统里不存在 dash（Debian/Ubuntu 的 shell）时才会创建；一律可用 sudoku-dash。

默认配置

项目	默认值
端口	随机 50001-65535
ASCII 模式	`up_ascii_down_entropy`（可选）
AEAD	`chacha20-poly1305`（可选）
自定义表 `custom_table`	每次安装随机生成（X / P / V 排列）
下行	packed（`enable_pure_downlink: false`）
Padding	服务端 2–7
HTTP Mask	启用 · `auto` · multiplex `on` · 随机路径前缀（客户端导出为 `httpmask.disable: true`）
WARP	`false`
统计 API	内核支持时自动开启：`127.0.0.1:<随机端口>` + 随机 `secret`（仅本机）
回落	内置 Cloudflare 风格 500 页 `127.0.0.1:10232`（失败回退 80 端口）
客户端本地端口	`10233`
路径	配置 `/etc/sudoku/config.json` · 二进制 `/usr/local/bin/sudoku` · 服务 `sudoku`（WARP 模式为 `sudoku-sing-box`）

支持的客户端

完整列表见 Sudoku 官方仓库，推荐：

Android：官方 Sudodroid / CMFA
iOS：Anywhere（GitHub）
桌面端：官方 sudoku-desktop

此外支持 OpenWrt（OpenClash）与 Mihomo（> v1.19.21）。分享链接 sudoku://… 可直接导入。

English

One-line install

Run as root on a Linux server (systemd or OpenRC/Alpine, amd64 / arm64):

curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && sudo bash /tmp/sudoku-dash.sh

Just keep pressing Enter: port (default: random) → AEAD (default chacha20-poly1305) → ASCII mode (default up_ascii_down_entropy) → enable WARP (default: no). Everything else (random custom_table, packed downlink, HTTP mask auto + random path root, CF-style fallback page) uses defaults and is never asked. You get a sudoku:// share link right away.

After installing, the script lives on as a repeatable management TUI, sudoku-dash:

sudo sudoku-dash

Live bandwidth: server RX / TX rate, sparkline, totals and peaks, per-client-IP rates
Resource usage: Sudoku CPU / RAM / connections / threads / FDs, system load
Users: per-user online state, live up/down rate and this month's usage vs. quota; add / rate-limit / data-cap / block / delete users, one share link per user
Versions: upgrade to latest, install any release or pre-release, automatic rollback on failure, manual rollback to a backup
Service / settings: restart, stop, view and follow logs, change port, toggle WARP, change public host

Non-interactive runs (curl … | sudo bash, CI) take the defaults and never prompt.

Alpine / NAT boxes: Alpine ships without curl and bash, so install them first (the script pulls in python3, jq, openssl, iproute2 and ca-certificates itself via apk, registers the services with OpenRC, and logs to /var/log/<service>.log):

apk add --no-cache curl bash && curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && bash /tmp/sudoku-dash.sh

On NAT hosts only the forwarded ports work: enter a forwarded port in the wizard (or SUDOKU_PORT=…) and set SERVER_IP=<NAT public address> for the share links.

Environment variables

All optional; put them before the command, e.g. sudo SUDOKU_PORT=8443 SUDOKU_WARP=true bash /tmp/sudoku-dash.sh. A variable you set is never asked about in the wizard.

Variable	Default	Meaning
`SUDOKU_PORT`	random 50001-65535	Server listen port (use this to customize the port)
`SUDOKU_AEAD`	`chacha20-poly1305`	Cipher: `chacha20-poly1305` / `aes-128-gcm` / `none`
`SUDOKU_ASCII`	`up_ascii_down_entropy`	ASCII mode: `up_ascii_down_entropy` / `prefer_entropy` / `prefer_ascii` / `up_entropy_down_ascii`
`SUDOKU_WARP`	`false`	`true` = send all proxied traffic out through Cloudflare WARP (hides the VPS egress IP, unlocks geo-restrictions). Switches to sudoku-sing-box; legacy name `SUDOKU_WARP_GOOGLE` still works
`SUDOKU_VERSION`	latest release	Sudoku release tag to install, e.g. `v0.5.1`
`SERVER_IP`	auto-detect	Public IP or domain written into share links
`SUDOKU_YES`	auto	`1` = never prompt; defaults to `1` without a TTY
`SUDOKU_LANG`	from `$LANG`	UI language: `zh` / `en`
`SUDOKU_CLIENT_PORT`	`10233`	Local proxy port in the exported client config
`SUDOKU_FALLBACK`	built-in CF-style 500 page	Fallback `host:port` for suspicious traffic; when customized it is never overridden
`SUDOKU_CF_FALLBACK`	`true`	`false` = skip the built-in fallback page, fall back to `127.0.0.1:80`
`SUDOKU_CF_FALLBACK_BIND` / `_PORT` / `_FALLBACK_PORT` / `_FORCE`	`127.0.0.1` / `10232` / `80` / `false`	Bind address, port, backup port of the built-in page, and whether to force-override `SUDOKU_FALLBACK`
`SUDOKU_HTTP_MASK`	`true`	HTTP mask on/off
`SUDOKU_HTTP_MASK_MODE`	`auto`	`auto` / `stream` / `poll` / `legacy` / `ws`
`SUDOKU_HTTP_MASK_TLS`	`false`	Use TLS for the HTTP mask
`SUDOKU_HTTP_MASK_HOST`	empty	Override the HTTP mask Host
`SUDOKU_HTTP_MASK_PATH_ROOT`	random 6-10 lowercase letters	Single path segment `[A-Za-z0-9_-]+`
`SUDOKU_HTTP_MASK_MULTIPLEX`	`on`	`off` / `auto` / `on`
`SUDOKU_SUBSCRIPTION_PATH`	`/etc/sudoku/subscription.yaml`	Output path of the generated Mihomo YAML
`SUDOKU_SUBSCRIPTION_NODE_NAME`	`sudoku`	Node name in the YAML
`SUDOKU_SUBSCRIPTION_TEMPLATE_URL`	built-in template	Custom Mihomo template (must contain `rule-providers:`)
`SUDOKU_REPO`	`SUDOKU-ASCII/sudoku`	Kernel repository

Custom port

# at install time
curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && sudo SUDOKU_PORT=8443 bash /tmp/sudoku-dash.sh
# afterwards: sudo sudoku-dash → Settings → Change port (firewall and service are updated; clients need the new link)

WARP

# enable at install time
curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh && sudo SUDOKU_WARP=true bash /tmp/sudoku-dash.sh
# toggle any time: sudo sudoku-dash → Settings → Enable / Disable WARP

About user management

User control relies on the kernel's users whitelist. The current release (v0.5.1) silently ignores it; you need Sudoku ≥ 0.5.2 (merged upstream, not released yet) or WARP mode (the bundled sudoku-sing-box already supports it). On an unsupported kernel dash says so instead of pretending limits are active.
Adding the first user also adds your install-time key as user default, so existing clients are not locked out.
User changes need a service restart (dash offers to do it for you).
Per-user live data comes from the kernel's RESTful API (external_controller, read-only, new on Sudoku main). When the kernel supports it (Sudoku main in direct mode, or the new sudoku-sing-box in WARP mode, which serves the same /users shape through its Clash API), install / upgrade writes external_controller (a random port on 127.0.0.1 only) plus a random secret into the config; on an existing install, open dash → Users and it offers to enable it in one step. Once on, dash shows:
- each user's online / idle / blocked / exceeded state, connection count, and live download / upload rate;
- usage this month (wire bytes, persisted by the kernel in config.usage.json so restarts don't lose it, reset on the 1st of each month in server local time), quota, remaining, a progress bar and the reset date;
- totals since the process started; the overview and Live bandwidth screens list per-user rates too.
A user who uses up their quota (data, in GB, 1 GB = 10⁹ bytes) has live connections closed and new ones refused; to reset one user early, stop the service and delete their entry from config.usage.json.
WARP mode is covered too: sudoku-sing-box shares the same config.usage.json as direct mode, so usage survives switching between them. That kernel's release tag is re-published in place (same tag, newer binary), so sudo sudoku-dash --upgrade (or dash → Versions) compares the GitHub asset identity and refreshes sing-box when there is a new build, even if the Sudoku version is unchanged.
Not available: the v0.5.1 release or an older sudoku-sing-box build — dash then shows speed limits / quota / state plus log-derived session counts and says why on screen; sudo sudoku-dash --upgrade refreshes sing-box.

Upgrade / uninstall

# upgrade to the latest release (also refreshes dash):
sudo sudoku-dash --upgrade
# or in the TUI: sudo sudoku-dash → Versions (pick a version, roll back; a failing upgrade rolls back automatically)

# uninstall (interactive runs ask whether to also delete config and keys):
sudo sudoku-dash --uninstall
# when the script is not on the box:
curl -fsSL https://raw.githubusercontent.com/SUDOKU-ASCII/easy-install/main/install.sh -o /tmp/sudoku-dash.sh
sudo bash /tmp/sudoku-dash.sh --uninstall

Other commands: sudoku-dash status (plain-text status), sudoku-dash --help.

The short name dash is only linked when no dash exists (Debian/Ubuntu ship a shell with that name); sudoku-dash always works.

Default configuration

Item	Default
Port	random 50001-65535
ASCII mode	`up_ascii_down_entropy` (selectable)
AEAD	`chacha20-poly1305` (selectable)
`custom_table`	random per install (X / P / V layout)
Downlink	packed (`enable_pure_downlink: false`)
Padding	server 2–7
HTTP mask	enabled · `auto` · multiplex `on` · random path root (client export uses `httpmask.disable: true`)
WARP	`false`
Stats API	auto-enabled when the kernel supports it: `127.0.0.1:<random port>` + random `secret` (local only)
Fallback	built-in Cloudflare-style 500 page on `127.0.0.1:10232` (port 80 as backup)
Client local port	`10233`
Paths	config `/etc/sudoku/config.json` · binary `/usr/local/bin/sudoku` · service `sudoku` (`sudoku-sing-box` in WARP mode)

Supported clients

See the official Sudoku repo for the full list. Recommended:

Android: official Sudodroid / CMFA
iOS: Anywhere (GitHub)
Desktop: official sudoku-desktop

OpenWrt (OpenClash) and Mihomo (> v1.19.21) are supported too. The sudoku://… share link imports directly.

Name		Name	Last commit message	Last commit date
third_party		third_party
README.md		README.md
install.sh		install.sh

Navigation Menu

Repository navigation

About

Repository files navigation

Sudoku 一键部署 & dash 管理面板

中文

一键安装

环境变量

用户管理说明

升级 / 卸载

默认配置

支持的客户端

English

One-line install

Environment variables

About user management

Upgrade / uninstall

Default configuration

Supported clients

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

Sudoku 一键部署 & dash 管理面板

中文

一键安装

环境变量

用户管理说明

升级 / 卸载

默认配置

支持的客户端

English

One-line install

Environment variables

About user management

Upgrade / uninstall

Default configuration

Supported clients

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages