dashti75/mist repository overview

⁠Mist

Mist is a self-hosted web manager for a WireGuard-to-Xray gateway. It manages WireGuard peers, complete Xray subscriptions, supported proxy links and routing rules from a browser.

It includes userspace WireGuard, Xray and pinned GeoIP/GeoSite data. No privileged container, kernel WireGuard module or /dev/net/tun is required.

⁠Install with Docker

The 0.1.2 and latest tags select the matching image automatically for Linux AMD64, ARM64 or ARMv7.

docker pull dashti75/mist:0.1.2
docker run -d \
  --name mist \
  --restart unless-stopped \
  -p 8080:8080/tcp \
  -p 51820:51820/udp \
  -v mist-data:/data \
  dashti75/mist:0.1.2

Open http://YOUR_DOCKER_HOST:8080. Read the first-boot setup token with:

docker logs mist

Use that token to create the administrator password in the web panel. Keep the management port accessible only to your trusted network, or configure HTTPS. The persistent /data volume stores settings, credentials and WireGuard keys.

⁠Docker Compose

services:
  mist:
    image: dashti75/mist:0.1.2
    container_name: mist
    restart: unless-stopped
    ports:
      - "8080:8080/tcp"
      - "51820:51820/udp"
    volumes:
      - mist-data:/data
volumes:
  mist-data:

Save as compose.yaml, then run docker compose up -d.

⁠Configure the gateway

1. Add a subscription or supported proxy link and fetch it.
2. Select an outbound profile. Add the router's WireGuard public key and allowed source CIDRs: its tunnel host /32 and each LAN subnet it forwards.
3. Set the reachable Docker host address as the WireGuard endpoint in the router configuration. Publish the same UDP port configured in Mist; if you change the default port, update the Docker port mapping too.
4. Save and apply, then start the gateway. Configure client policy routing through WireGuard. Keep the Docker host/endpoint outside that policy to avoid a loop.
5. Test a real HTTPS request from a routed client. A running container alone does not prove connectivity to the upstream proxy.

The RouterOS script generator assigns the router tunnel interface address with /24. Peer authorization for the router's individual source address remains /32. Review generated routing/firewall rules for your network before importing them.

⁠Serverless for Iran

Project and usage instructions: patterniha/Serverless-for-Iran⁠.

Subscription:

https://raw.githubusercontent.com/patterniha/Serverless-for-Iran/refs/heads/main/Subscription/Serverless-for-Iran.json

Mist imports the complete profile, preserving its DNS, FakeDNS, routing and fragmentation dependencies. Serverless uses direct connections: it does not provide a foreign exit IP or overcome every IP-level block. Consult the upstream README for DNS, IPv6 and client-specific requirements. Mist is an independent project.

⁠Tags and updates

• latest, 0.1.2: multi-platform images.
• 0.1.2-amd64, 0.1.2-arm64, 0.1.2-armv7: architecture-specific images.

Back up /data before upgrading and retain the same volume. With Compose:

docker compose pull
docker compose up -d

Version 0.1.2 preserves XHTTP link extra settings, including padding and headers. When upgrading from an older import, fetch the affected subscription again to regenerate the saved profile. Full JSON profiles retain their explicit settings.

⁠Source and license

Mist is distributed under GPL-3.0-only. A sanitized source archive for this build, licenses and third-party notices are included under /usr/share/doc/mist/. To extract the source without running the application:

docker create --name mist-source dashti75/mist:0.1.2
docker cp mist-source:/usr/share/doc/mist/source.tar.gz ./mist-source.tar.gz
docker rm mist-source

The pinned Xray revision is recorded in the included build-lock.json. Xray source⁠.