[Feature]: Automatic rotation of Reality short IDs

[nickshiro]

Is your feature request related to a problem?

Currently, Reality shortIds for VLESS inbounds must be manually regenerated and updated through the panel whenever a target domain or fingerprint gets flagged by DPI systems. In regions with active DPI (e.g., Russia's TSPU¹), short ID lists can accumulate detectable statistical patterns over time, and manually rotating them across multiple inbounds is tedious and error-prone, especially when running several Reality inbounds simultaneously.

¹ https://ooni.org/post/2024-russia-report/

Describe the solution you'd like

Add an optional auto-renew setting for Reality shortIds per inbound, similar to how some panels handle automatic cert renewal. For example, configurable rotation interval (e.g., every N days) that regenerates a subset or all of the shortIds list automatically. Optional, webhook on rotation so admins running automation (e.g., Telegram bots) can react to the change.

Alternatives you've considered

• Manually regenerating short IDs via xray x25519/reality-shortid and updating the panel by hand
• Cron script hitting the 3x-ui API to PATCH inbound settings

Concrete use case

No response

Mockups, screenshots, or examples

No response

Which parts of the panel would this affect?

No response

Are you willing to help?

• I can help test once a PR is open.
• I'd like to implement this feature myself and open a PR.

Before submitting

• I searched existing issues and this feature has not been requested.
• This feature request is written in English.

[github-actions]

Automatic shortIds rotation is not currently supported. There is no existing backend or scheduling support to build on, confirmed in the source:

• shortIds is a plain string[] in the Reality schema (frontend/src/schemas/protocols/security/reality.ts:64), stored server-side only inside the opaque Inbound.StreamSettings JSON column (internal/database/model/model.go:65) — there is no dedicated backend modeling for Reality fields today.
• Regeneration is entirely manual and client-side: the reload button next to shortIds (frontend/src/pages/inbounds/form/security/reality.tsx:139-149) calls randomizeShortIds() (frontend/src/pages/inbounds/form/useSecurityActions.ts:126-131), which builds new IDs in the browser via RandomUtil.randomShortIds() (frontend/src/utils/index.ts:174). Unlike the X25519 keypair or ML-DSA-65 seed, which have dedicated server endpoints (/panel/api/server/getNewX25519Cert, /getNewmldsa65), there is no server-side generator for shortIds.
• No cron job touches Reality settings on a schedule. All periodic jobs are registered in internal/web/web.go (roughly lines 313-397); none reference Reality.
• There is no generic outbound webhook/notification framework in the backend. The panel's actual "notify on event" channels are the Telegram bot (internal/web/service/tgbot/) and a small in-process event bus with a fixed event enum (internal/eventbus/events.go: outbound up/down, xray.crash, node up/down, cpu/memory high, login.attempt) — nothing Reality-related exists to hook into yet.

The closest existing precedent for "auto-renew on an interval" is the traffic-reset feature, a reasonable shape to copy: Inbound.TrafficReset (enum never|hourly|daily|weekly|monthly, default never) plus Inbound.LastTrafficResetTime timestamp (internal/database/model/model.go:56-57), consumed by PeriodicTrafficResetJob (internal/web/job/periodic_traffic_reset_job.go) and registered at @hourly/@daily/@weekly/@monthly in internal/web/web.go:347-353 via InboundService.GetInboundsByTrafficReset. A rotation-interval + last-rotated field on the Reality settings, read by a new job modeled on that one, would fit the existing architecture. The webhook-on-rotation part is separate, larger scope — there is no generic webhook caller anywhere in the backend to extend, so it would mean either building one or routing through the existing tgbot/event-bus path instead.

Your second listed alternative already works today: POST /panel/api/inbounds/update/:id (internal/web/controller/inbound.go:74) accepts the full inbound, including streamSettings.realitySettings.shortIds, so an external cron script can PATCH it now.

If you go ahead with a PR, note two of this repo's hard requirements for this kind of change: any new Inbound/settings field needs a GORM migration in internal/database/db.go, and any new user-facing string (e.g. for a rotation-interval setting or webhook option) needs an English i18n key added to all 13 locale files under internal/web/translation/.

Labeled as a new feature and marked PR-welcomed, matching your intent to implement it. @MHSanaei — flagging for input on scope (rotation-interval design, and whether "notify on rotation" should reuse tgbot/event-bus rather than introduce a new generic webhook subsystem) before implementation starts.

This reply was generated automatically by an AI agent; a maintainer may follow up.