shitouxiaoge-commits/CFAPEX

Overview

CFAPEX is a proxy panel intended to run on Cloudflare Workers or Pages Advanced Mode. It serves VLESS/WS, Trojan/WS, and VLESS/XHTTP nodes and gives operators a web UI for preferred IPs, region-based Proxy IP candidates, custom outbound proxies, and node UUIDs. Clients receive subscriptions as Clash/Mihomo YAML, generic URI, or sing-box JSON. Settings are stored in a KV namespace, and subscription tokens are separate from the panel password.

The project targets people who already work with Cloudflare Workers/Pages and proxy clients and want a self-hosted panel rather than a hosted service.

Quick start

1. Create a dedicated KV namespace (for example CFAPEX_CONFIG) and plan to bind it to the project under the name K. Bindings are not ordinary text variables.
2. Deploy one of the tracked deliverables: dist/CFAPEX-worker.1.3.js as a single Worker module, or upload the Pages Advanced Mode ZIP containing the root _worker.js (or the dist/pages-panel directory). Do not paste the Pages ZIP into the Worker editor.
3. Set the required environment variable A to a panel password. A default node UUID is derived from it; alternates are TROJAN_PASSWORD, TROJAN=0, XHTTP=0, and OUTBOUND_PORTS.
4. Save and deploy, then open the panel at https://<deployment-domain>/<value-of-A>. Use URL encoding or a simple random password if it contains spaces, Chinese characters, /, ?, #, or %.
5. In the overview, copy the separate /s/<token> subscription URL. Choose Clash YAML for Clash/Mihomo, generic URI for v2rayN, or ?format=singbox for sing-box desktop, then refresh the subscription and reconnect in the client.

Detailed deployment and client options appear in the project's usage tutorial usage tutorial.

Constraints

• The active panel version is distinct from the lightweight src/worker.js; the tutorial's steps apply to the panel build. The pre-harden baseline src/worker.js.pre-harden should not be deployed.
• Without a KV binding named K, settings live only in edge cache and can revert. The restore-default button clears the entire bound namespace, so use a dedicated namespace.
• Custom preferred IPs are capped at 1000 deduplicated nodes and 262144 characters, with a 256 KiB limit per remote source; a failed remote source keeps the old list.
• Region Proxy IPs are limited to 100 entries and 16000 characters. They only affect Cloudflare IPv4 TLS targets and are not guaranteed to appear as the observed egress IP.
• Custom outbound supports SOCKS5, HTTP(S), and Shadowsocks with three AEAD methods only; SS2022 and plugins are unsupported. auto can fall back to direct, while only fails instead of falling back.
• Changing A changes the panel path, subscription tokens, and default derived UUID, requiring clients to re-import subscriptions.
• Reading the README notes that the code performs local syntax, protocol, KV-read, and workerd regression checks, but public network behavior, mobile connectivity, sing-box desktop import, and Cloudflare quota effects still require post-deployment verification.
• No license is declared in the repository metadata.

HotRepo's take

The only recorded ranking data is a 2026-11-12 new-project entry showing 119 stars and 71 forks, with 8 stars gained in the observed window. The star curve only covers a brief window on the same day, so it does not support a trend claim. More notable than the counts is the fork-to-star ratio: the repository is a deployable single-file panel aimed at operators who will copy or adapt the deployment, which fits a distribution pattern where forks can be high. With no best daily rank recorded, there is no basis to call it a trending project; evaluate it on the deployment and verification details instead.