OutlineFoundation/outline-server
Outline Server
Outline is a server that manages and runs Shadowsocks proxy instances, each isolated inside its own Docker container, to provide encrypted internet access. It is designed to bypass censorship by routing traffic through secure tunnels that use AEAD cipher encryption and traffic obfuscation to resist detection. Access to the proxy servers is controlled through a REST API that allows administrators to create, list, and revoke cryptographic access keys.
The server automates the provisioning and configuration of proxy servers on cloud platforms like DigitalOcean, simplifying deployment through a manager application. It includes active probing resistance to handle invalid bytes and replayed data, preventing censors from identifying the proxy. Optional anonymous metrics reporting sends anonymized server statistics to a separate REST service for operational monitoring without identifying users.
The system enforces authenticated encryption with associated data ciphers and generates long random secrets to prevent traffic decryption. It also merges SOCKS addresses with initial encrypted data and randomizes packet sizes to evade packet-level detection. Each Shadowsocks instance runs in its own Docker container for process isolation and simplified lifecycle management.
Features
- Shadowsocks Tunnel Implementations - Implements the Shadowsocks protocol to encrypt and tunnel TCP traffic through a SOCKS5 proxy.
- Shadowsocks Server Managers - Automates deployment and management of Shadowsocks proxy servers with encryption-based tunneling and REST API access control.
- Docker Container Execution - Runs each Shadowsocks proxy instance in its own Docker container for isolation.
- Shadowsocks Container Deployments - Deploys each Shadowsocks proxy instance inside its own Docker container for process isolation.
- Multi-Layer Detection Resistance - Uses AEAD ciphers, probing resistance, and replay protection to prevent censorship systems from detecting proxy traffic.
- Docker-Isolated Instance Managers - Launches and manages individual Shadowsocks proxy instances inside Docker containers with unique access keys.
- Access Key Management - Creates, lists, and removes Shadowsocks access keys through a REST API to control proxy server access.
- API Key Revokers - Creates, lists, and revokes proxy access keys via a REST API to control server access.
- REST API Key Managers - Provides a REST API for creating, listing, and revoking cryptographic access keys that control proxy access.
- via REST API - Provides a RESTful interface for creating, listing, and revoking proxy access keys.
- Censorship Circumvention Tools - Bypasses internet censorship by routing traffic through encrypted Shadowsocks tunnels.
- AEAD Cipher Implementations - Enforces AEAD ciphers like chacha20-poly1305 and aes-256-gcm for encrypted proxy traffic.
- Docker-Based Secure Proxy Deployments - Deploys Shadowsocks proxy servers as Docker containers on DigitalOcean for secure access.
- Managed Cloud Application Deployments - Automates provisioning and configuration of proxy servers on cloud platforms like DigitalOcean.
- Cloud Platform Deployments - Creates and configures proxy servers on DigitalOcean and other cloud providers.
- Application Cloud Deployments - Automates deployment of proxy server applications to cloud hosting environments.
- Cloud Infrastructure Automation - Automates provisioning and configuration of proxy servers on DigitalOcean and other cloud platforms.
- Cloud-Provisioned Proxy Servers - Automates deployment and configuration of proxy servers on DigitalOcean and other cloud platforms.
- Active Probing Resistance Mechanisms - Handles invalid bytes and replayed data to prevent censors from identifying the proxy through active probing.
- Traffic Obfuscation - Hides proxy traffic characteristics by randomizing packet sizes and merging addresses.
- Packet Size Randomizers - Merges SOCKS addresses with encrypted data and randomizes packet sizes to evade detection.
- Traffic Size Obfuscation Techniques - Merges SOCKS addresses with initial encrypted data and randomizes packet sizes to evade packet-level detection.
