Add optional AWG 3.0 protocol mode

.gitattributes

@@ -1,4 +1,6 @@
+.gitattributes text eol=lf
 *.sh text eol=lf
+amneziawg-web/scripts/amneziawg-web-privileged text eol=lf
 *.yml text eol=lf
 *.yaml text eol=lf
 *.md text eol=auto

.github/workflows/lint.yml

@@ -27,6 +27,7 @@ jobs:
           bash -n amneziawg-proxy/scripts/amneziawg-proxy-uninstall.sh
           bash -n amneziawg-proxy/scripts/amneziawg-proxy-upgrade.sh
           bash -n tests/test-cargo-build-common.sh
+          bash -n tests/test-awg3.sh
           bash -n tests/test-proxy-bootstrap.sh
           bash -n tests/test-ubuntu-ppa.sh
           bash -n tests/test-ubuntu-resolute-live.sh
@@ -55,6 +56,7 @@ jobs:
           shellcheck --severity=warning amneziawg-proxy/scripts/amneziawg-proxy-uninstall.sh
           shellcheck --severity=warning amneziawg-proxy/scripts/amneziawg-proxy-upgrade.sh
           shellcheck --severity=warning tests/test-cargo-build-common.sh
+          shellcheck --severity=warning tests/test-awg3.sh
           shellcheck --severity=warning tests/test-proxy-bootstrap.sh
           shellcheck --severity=warning tests/test-ubuntu-ppa.sh
           shellcheck --severity=warning tests/test-ubuntu-resolute-live.sh

.github/workflows/test.yml

@@ -22,6 +22,7 @@ jobs:
       - name: Run unit tests
         run: |
           bash tests/test-functions.sh
+          bash tests/test-awg3.sh
           bash tests/test-cargo-build-common.sh
           bash tests/test-ubuntu-ppa.sh
           bash tests/test-proxy-scripts.sh

README.md

@@ -359,6 +359,33 @@ sudo ./amneziawg-install.sh --list-clients
 
 ---
 
+## 🔐 Optional AWG 3.0 Mode
+
+Fresh installs and parameter files created by earlier releases use AWG 2.0 by
+default. Installing or upgrading this project never changes an existing
+interface's protocol mode.
+
+```bash
+# Missing protocol state is reported as 2.0
+sudo ./amneziawg-install.sh --protocol-status
+
+# Probe userspace + running kernel support, then migrate the server and clients
+sudo ./amneziawg-install.sh --enable-awg3
+
+# Atomically remove AWG 3.0-only fields and return every config to AWG 2.0
+sudo ./amneziawg-install.sh --disable-awg3
+```
+
+AWG 3.0 header protection is interface-wide and cannot communicate with AWG
+2.0 clients on the same interface. Enabling it creates one shared header key,
+validates all generated configs, and updates the server plus every recoverable
+client config as one transaction. If capability validation, file replacement,
+service restart, or the process itself fails, the previous state is restored.
+Redistribute every client config after either migration. The web panel exposes
+the same confirmed operations under **AWG protocol**.
+
+---
+
 ## 📦 Requirements
 
 Supported Linux distributions: