Summary. Below — why four protocols, how multi-server is wired, and where the billing pain sits.
Why four protocols. One protocol doesn't solve every job. WireGuard is fast, but providers in Russia and Iran learned long ago to fingerprint the UDP handshake and throttle it. Hysteria2 over QUIC on port 443 disguises itself as HTTPS traffic to a CDN — it bypasses most filters. HTTP proxy is needed when the user only wants to route the browser, not all traffic. SOCKS5 is the fallback for apps that don't speak WireGuard and don't get along with QUIC.
Multi-server. vps1 in Amsterdam (Dutch jurisdiction, EU, low latency for Europe), vps2 in New York (US East), vps4 in Salt Lake City (US West, closer for some). Each server is described in the servers table: SSH access, WireGuard public key, Hysteria2 domain + obfs password, proxy ports. When the user requests a new config, the bot SSHes to the chosen server, adds a peer, and returns the ready config + QR.
Billing and limits. Limits are tracked bot-side — each user has a users.tariff record with allowed config count and traffic. cleanup.py runs from cron, SSHes through the servers, pulls traffic stats via WireGuard wg show transfer and Hysteria2 metrics, updates usage_logs. Over the cap → nudge in Telegram and temporary block.
Channel subscription as gate. Subscription middleware checks that the user is subscribed to @izgoy4u before every menu response. Unsubscribed → bot stays silent and asks them to resubscribe. Organic channel growth + multi-account defence.
No k8s, no Docker. Single SQLite file, systemd unit, paramiko for SSH. 67 users don't require anything beyond an aiogram app in one process. Complexity would only be justified at a real payment processor and tens of thousands of users — but the current architecture scales to thousands without changes.