For VPN providers

Moving users from Happ to Rameta

Rameta understands Happ subscriptions as-is: same request and response headers, same body formats and links. The Remnawave HWID limit works unchanged. Below is everything you need so users can simply tap “Open in Rameta”.

1. Quick start

2. What Rameta sends

Every subscription update is a plain GET with these headers:

3. Response headers

Same set and values as Happ. In Remnawave they live in “Subscription settings → custom response headers” and reach Happ and Rameta alike.

The same keys may also be sent in the body as leading #key: value lines, and in the URL fragment:

https://sub.example.com/abcdef#Мой VPN?profile-update-interval=6&support-url=https://t.me/myvpn_support

If a key is set in several places, the body line wins, then the response header, then the URL fragment (same as Happ).

4. Subscription formats

• Share links — base64 (standard or URL-safe, padded or not) or plain text, one per line: vless://, vmess://, trojan://, ss://, socks://, hysteria2:// / hy2://.
• Xray JSON — an array of full configs (each with remarks) or a single config. Outbounds, routing, dns and balancers are used; Rameta supplies its own inbounds.
• age-encrypted body — ASCII-armored (-----BEGIN AGE ENCRYPTED FILE-----) or binary; decrypts to any format above. →
• Remnawave server descriptions (serverDescription): meta.serverDescription in JSON, and a ?serverDescription=<base64> suffix after the name in links.

vless://uuid@de1.example.com:443?type=tcp&security=reality&sni=www.microsoft.com&pbk=…&sid=…&fp=chrome&flow=xtls-rprx-vision#🇩🇪 Germany
trojan://password@nl.example.com:443?security=tls&sni=nl.example.com#🇳🇱 Netherlands
ss://YWVzLTEyOC1nY206cGFzcw@fi.example.com:8388#🇫🇮 Finland
hy2://auth@jp.example.com:443?sni=jp.example.com#🇯🇵 Japan

Body with metadata lines:

#profile-title: base64:0JzQvtC5IFZQTg==
#profile-update-interval: 6
#support-url: https://t.me/myvpn_support
#announce: Новые серверы в Казахстане!
vless://…#🇩🇪 Germany
vless://…#🇳🇱 Netherlands

5. Remnawave

Response Rule for Xray JSON

Panel → Subscription → Response Rules. Add this rule after “Browser Subscription” and before “Fallback Base64” (rules are checked top-down, the first match wins):

{
  "name": "Rameta",
  "enabled": true,
  "operator": "AND",
  "conditions": [
    {
      "headerName": "user-agent",
      "operator": "REGEX",
      "value": "^Rameta/",
      "caseSensitive": true
    }
  ],
  "responseType": "XRAY_JSON",
  "responseModifications": {
    "additionalExtendedClientsRegex": [
      "^Rameta/"
    ]
  }
}

• XRAY_JSON — Rameta receives the full Xray config of every host: XHTTP, Reality, fragmentation, mux and host templates are kept.
• additionalExtendedClientsRegex — Remnawave treats Rameta as an “extended client” like Happ and INCY and passes server descriptions (serverDescription).

Subscription page button

In the Remnawave Subscription Page settings add Rameta for iOS with an “add subscription” button:

rameta://add/{{SUBSCRIPTION_LINK}}

The App Store link will be published at release; until then use TestFlight.

6. Encrypted subscriptions

Remnawave can encrypt the response body with age. Add encryption with the Rameta public key (method age1, X25519) to the Rameta rule:

{
  "additionalExtendedClientsRegex": [
    "^Rameta/"
  ],
  "encryption": {
    "method": "age1",
    "key": "age1zaymjnnxuh8xsmrw9cjajm4gqnjsgtxf6e8v54zx3rpejqsluyls0eymfz"
  }
}

Rameta public key: age1zaymjnnxuh8xsmrw9cjajm4gqnjsgtxf6e8v54zx3rpejqsluyls0eymfz (always current at /v1/app/config → agePublicKey).

A custom backend can also encrypt per device with the key from X-Age-Public-Key (age1pq1…). Remnawave uses a static key per rule, so use age1 with the Rameta key there.

7. Deep links

8. Routing profiles

The format is Happ-compatible: the JSON below, base64-encoded, is delivered as rameta://routing/add/… (or onadd), via the routing header or your provider card.

{
  "Name": "Мой VPN — РФ напрямую",
  "GlobalProxy": "true",
  "RemoteDNSType": "DoH",
  "RemoteDNSDomain": "https://cloudflare-dns.com/dns-query",
  "RemoteDNSIP": "1.1.1.1",
  "DomesticDNSType": "DoU",
  "DomesticDNSDomain": "",
  "DomesticDNSIP": "77.88.8.8",
  "Geoipurl": "https://vpn.rameta.net/geo/geoip.dat?tags=ru,private",
  "Geositeurl": "https://vpn.rameta.net/geo/geosite.dat?tags=category-ru,private",
  "LastUpdated": "1761609600",
  "DnsHosts": {},
  "DirectSites": [
    "geosite:category-ru",
    "geosite:private",
    "domain:ru",
    "domain:xn--p1ai"
  ],
  "DirectIp": [
    "geoip:ru",
    "geoip:private"
  ],
  "ProxySites": [
    "domain:youtube.com",
    "keyword:openai"
  ],
  "ProxyIp": [
    "91.108.4.0/22"
  ],
  "BlockSites": [
    "geosite:category-ads"
  ],
  "BlockIp": [],
  "DomainStrategy": "IPIfNonMatch",
  "FakeDNS": "false"
}

Domain rules use Xray syntax: domain: (domain and subdomains), full: (exact), keyword:, regexp:, geosite:. IPs: address, CIDR or geoip:. Order: block → proxy → direct → default (GlobalProxy). Rameta also accepts RouteOrder (default block-proxy-direct).

# make a link from a profile file
echo "rameta://routing/onadd/$(base64 -w0 profile.json)"

Ready-made profiles

The same profiles are served by /v1/presets together with 50+ services and domain zones.

9. Trimmed geo files

The iOS VPN extension has ~50 MB of memory while the full geosite.dat is ~70 MB. So Rameta (and your profile) fetches only the entries it needs:

https://vpn.rameta.net/geo/geosite.dat?tags=category-ru,private,category-ads
https://vpn.rameta.net/geo/geoip.dat?tags=ru,private

Source: runetfreedom/russia-v2ray-rules-dat (updated daily). Useful tags: category-ru, ru-blocked, ru-available-only-inside, category-ads-all, category-gov-ru, category-ai-!cn; geoip: ru, private, ru-blocked, ru-blocked-community, telegram. Full list: /geo/tags.

10. Provider registry

Register so Rameta shows your logo, color, announcement and offers your routing profile. Then send providerid: <your id> in the subscription. The “verified” badge is granted manually after we contact you.

11. Crypt link generator

Turns a subscription URL into rameta://crypt/…: the payload is the binary age ciphertext for the Rameta public key, base64url without =. The URL is neither stored nor logged.

Same via the API, or locally without our server:

curl -s https://vpn.rameta.net/v1/crypt -H 'Content-Type: application/json' \
  -d '{"url":"https://sub.example.com/abcdef"}'
# → {"link":"rameta://crypt/YWdlLWVuY3J5cHRpb24ub3JnL3Yx…","armored":"-----BEGIN AGE ENCRYPTED FILE-----…"}

# Rameta public key: https://vpn.rameta.net/v1/app/config → agePublicKey
URL='https://sub.example.com/abcdef'
printf '%s' "$URL" | age -r age1zaymjnnxuh8xsmrw9cjajm4gqnjsgtxf6e8v54zx3rpejqsluyls0eymfz | basenc --base64url | tr -d '=\n' | sed 's|^|rameta://crypt/|'

12. API

Base: https://vpn.rameta.net. Responses are JSON; errors: {"error":"…","message":"…"}.

Updating your provider card:

curl -X PUT https://vpn.rameta.net/v1/providers/AbC123xY \
  -H 'Authorization: Bearer <adminToken>' -H 'Content-Type: application/json' \
  -d '{"logoUrl":"https://example.com/logo.png","color":"#7C3AED","announce":"Скидка 20% до пятницы",
       "routingProfile":{"id":"my-ru","name":"РФ напрямую","globalProxy":true,
         "direct":["geosite:category-ru","domain:ru"],"directIp":["geoip:ru","geoip:private"],
         "proxy":[],"proxyIp":[],"block":[],"blockIp":[],"domainStrategy":"IPIfNonMatch"}}'

PUT fields: name, website, supportUrl, logoUrl (https), color (#RRGGBB), announce (≤200), routingProfile (object as in /v1/presets, or null), contact, subscriptionDomains. Missing fields are untouched, null clears.