From bfc24c348a4d4cf4008172731aa2485102312f1c Mon Sep 17 00:00:00 2001
From: xboard <xboard>
Date: Sun, 22 Mar 2026 23:58:36 +0800
Subject: [PATCH] fix: fix Trojan compatibility

---
 internal/kernel/singbox/config.go | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/internal/kernel/singbox/config.go b/internal/kernel/singbox/config.go
index 55c3351..71b3a1c 100644
--- a/internal/kernel/singbox/config.go
+++ b/internal/kernel/singbox/config.go
@@ -485,12 +485,13 @@ func buildVLESS(base M, nc *panel.NodeConfig, users []panel.User, certFile, keyF
 func buildTrojan(base M, nc *panel.NodeConfig, users []panel.User, certFile, keyFile string) M {
 	base["type"] = "trojan"
 
-	userList := make([]M, 0, len(users))
-	for _, u := range users {
-		userList = append(userList, M{
+	userList := make([]M, len(users))
+	for i := range users {
+		u := &users[i]
+		userList[i] = M{
 			"name":     u.UUID,
 			"password": u.UUID,
-		})
+		}
 	}
 	base["users"] = userList
 
@@ -502,6 +503,14 @@ func buildTrojan(base M, nc *panel.NodeConfig, users []panel.User, certFile, key
 	} else if nc.TLS == 2 {
 		base["tls"] = buildRealityConfig(nc)
 	}
+
+	// Trojan requires TLS or Reality to be enabled.
+	// If the panel didn't explicitly set TLS=1 or TLS=2, but we have certs,
+	// we should enable a default TLS config to ensure the inbound can start.
+	if _, ok := base["tls"]; !ok {
+		base["tls"] = buildTLSConfig(nc, certFile, keyFile)
+	}
+
 	return base
 }
 
@@ -676,7 +685,7 @@ func applyTransport(base M, nc *panel.NodeConfig) {
 				transport["early_data_header_name"] = v
 			}
 		case "grpc":
-			if v, ok := nc.NetworkSettings["service_name"]; ok {
+			if v, ok := nc.NetworkSettings["serviceName"]; ok {
 				transport["service_name"] = v
 			}
 		case "httpupgrade":