1
sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install --beta

1
sudo systemctl stop xray

1
# 执行两次，得到两个不同的 UUID
2
xray uuid
3
xray uuid

1
xray x25519

1
openssl rand -hex 8

1
sudo tee /usr/local/etc/xray/config.json >/dev/null <<'EOF'
2
{
3
  "log": {
4
    "loglevel": "info" // 调试完成后可改为 "warning"
5
  },
6
  "inbounds": [
7
    {
8
      "listen": "0.0.0.0", // 如果需要 IPv6，改为监听 "::"
9
      "port": 443,
10
      "protocol": "vless",
11
      "settings": {
12
        "clients": [
13
          {
14
            "id": "UUID_01", // 对应客户端出站 1
15
            "level": 0,
16
            "email": "vision-user",
17
            "flow": "xtls-rprx-vision"
18
          },
19
          {
20
            "id": "UUID_02", // 对应客户端出站 2/3/4/5
21
            "level": 0,
22
            "email": "xhttp-user"
23
          }
24
        ],
25
        "decryption": "none",
26
        "fallbacks": [
27
          {
28
            "dest": "/run/xray/xhttp_in.sock",
29
            // 处理“直连”的 XHTTP 请求 (对应客户端出站 2/3/5 的直连部分)
30
            // 当 Reality 识别出 VLESS 协议但没有 flow 时，直接丢给内部 XHTTP Socket
31
            "xver": 0
32
          }
33
        ]
34
      },
35
      "streamSettings": {
36
        "network": "raw",
37
        "security": "reality",
38
        "realitySettings": {
39
          "show": false,
40
          "target": "/run/caddy/tls_gate.sock",
41
          // 处理“CDN 转发”或“普通 HTTPS”请求 (对应客户端出站 3/4/5 的 CDN 部分)
42
          // 任何 Reality 不识别的流量都丢给 Caddy 处理
43
          "xver": 0,
44
          "serverNames": [
45
            "reality.example.com",
46
            "cdn.example.com"
47
          ],
48
          "privateKey": "YOUR_REALITY_PRIVATE_KEY",
49
          "shortIds": ["YOUR_SHORT_ID"]
50
        },
51
        "sockopt": {
52
          "tcpFastOpen": true,
53
          "tcpCongestion": "bbr",
54
          "tcpMptcp": true
55
        }
56
      },
57
      "tag": "VISION+REALITY",
58
      "sniffing": {
59
        "enabled": true,
60
        "destOverride": ["http", "tls", "quic"],
61
        "metadataOnly": false,
62
        "routeOnly": true
63
      }
64
    },
65
    {
66
      "listen": "/run/xray/xhttp_in.sock",
67
      "protocol": "vless",
68
      "settings": {
69
        "clients": [
70
          {
71
            "id": "UUID_02",
72
            "level": 0,
73
            "email": "xhttp-user"
74
          }
75
        ],
76
        "decryption": "none"
77
      },
78
      "streamSettings": {
79
        "network": "xhttp",
80
        "xhttpSettings": {
81
          "host": "",
82
          "path": "/your-xhttp-path",
83
          "mode": "auto",
84
          "noSSEHeader": false,
85
          "scMaxEachPostBytes": 1000000,
86
          "scMaxBufferedPosts": 30,
87
          "xPaddingBytes": "100-1000",
88
          "xPaddingObfsMode": true,
89
          "xPaddingMethod": "tokenish", // 生成一个随机的 Base62 标记
90
          "xPaddingPlacement": "queryInHeader", // 填充嵌入 Referer URL query（CF 兼容）
91
          "xPaddingKey": "t", // URL query 参数名
92
          "xPaddingHeader": "Referer",
93
          "sessionIDPlacement": "path",
94
          "sessionIDKey": "SID",
95
          "sessionIDTable": "Base62",
96
          "sessionIDLength": "12-20"
97
        }
98
      },
99
      "tag": "XHTTP_IN",
100
      "sniffing": {
101
        "enabled": true,
102
        "destOverride": ["http", "tls", "quic"],
103
        "metadataOnly": false,
104
        "routeOnly": true
105
      }
106
    }
107
  ],
108
  "outbounds": [
109
    {
110
      "protocol": "freedom",
111
      "tag": "direct",
112
      "settings": {}
113
    },
114
    {
115
      "protocol": "blackhole",
116
      "tag": "blocked",
117
      "settings": {}
118
    }
119
  ],
120
  "routing": {
121
    "domainStrategy": "AsIs",
122
    "rules": [
123
      {
124
        "ip": ["geoip:private"],
125
        "outboundTag": "blocked"
126
      }
127
    ]
128
  }
129
}
130
EOF

1
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
2

3
# 导入 GPG 密钥
4
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
5

6
# 添加官方软件源
7
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
8

9
# 更新并安装
10
sudo apt update
11
sudo apt install caddy -y

1
sudo tee /etc/caddy/Caddyfile >/dev/null <<'EOF'
2
# 1. REALITY 域名区块（专供 REALITY 握手与伪装网页）
3
# 记得换成你自己的 REALITY 子域名！！！
4
reality.example.com {
5
        # 监听 Xray REALITY 回落的 Unix Socket
6
        bind unix//run/caddy/tls_gate.sock
7

8
        # 引用 acme.sh 申请的 Let's Encrypt 证书与私钥
9
        tls /etc/caddy/certs/reality.crt /etc/caddy/certs/reality.key
10

11
        log {
12
                output file /var/log/caddy/reality_access.log {
13
                        roll_size     10mib
14
                        roll_keep     7
15
                        roll_keep_for 168h
16
                }
17
        }
18

19
        # 处理所有其他访问
20
        # 外部扫描器或浏览器访问，直接给出伪装网页
21
        handle {
22
                # 伪装网页路径：/var/www/html/index.html
23
                root * /var/www/html
24
                file_server
25
        }
26
}
27

28
# 2. CDN 域名区块（处理从 Xray 回落的 CDN 代理流量）
29
# 记得换成你自己的 CDN 子域名！！！
30
cdn.example.com {
31
        bind unix//run/caddy/tls_gate.sock
32

33
        # 申请的是多域名合并证书，引用相同的证书文件即可
34
        tls /etc/caddy/certs/reality.crt /etc/caddy/certs/reality.key
35

36
        log {
37
                output file /var/log/caddy/cdn_access.log {
38
                        roll_size     10mib
39
                        roll_keep     7
40
                        roll_keep_for 168h
41
                }
42
        }
43

44
        # 捕获套 CDN 的出站（出站 3/4/5）传来的合法的 XHTTP 流量
45
        # 记得换成你自己的 XHTTP 路径！！！
46
        # 记得换成你自己的 XHTTP 路径！！！
47
        # 记得换成你自己的 XHTTP 路径！！！
48
        handle /your-xhttp-path/* {
49
                reverse_proxy unix//run/xray/xhttp_in.sock {
50
                        transport http {
51
                                versions 2
52
                        }
53
                        flush_interval -1
54
                }
55
        }
56

57
        # 可选：探针探活路径
58
        handle /status {
59
                respond "ok" 200
60
        }
61

62
        handle /ping {
63
                respond "ok" 200
64
        }
65

66
        # 对于扫描器，直接重定向到伪装网页防扫描
67
        # 记得换成你自己的 REALITY 子域名！！！
68
        handle {
69
                redir https://reality.example.com{uri}
70
        }
71
}
72
EOF

1
# 统一运行用户为 caddy
2
sudo mkdir -p /etc/systemd/system/xray.service.d
3
sudo tee /etc/systemd/system/xray.service.d/override.conf <<EOF
4
[Service]
5
User=caddy
6
EOF
7

8
# 为 Caddy 启用独立的运行目录以放套接字
9
sudo mkdir -p /etc/systemd/system/caddy.service.d
10
sudo tee /etc/systemd/system/caddy.service.d/override.conf <<EOF
11
[Service]
12
User=caddy
13
RuntimeDirectory=caddy
14
EOF
15

16
# 重新加载 Systemd 配置
17
sudo systemctl daemon-reload

1
# SSH 登录 VPS 并切换到 root
2
sudo -i
3

4
# 设置你的真实邮箱，并安装 acme.sh
5
EMAIL="your_email@example.com"
6
curl https://get.acme.sh | sh -s email="$EMAIL"
7

8
# 切换默认颁发机构为 Let's Encrypt
9
ACME=/root/.acme.sh/acme.sh
10
$ACME --set-default-ca --server letsencrypt

1
# 执行后，直接粘贴你的 Token 并回车（屏幕上不会显示）
2
read -rsp 'Cloudflare API Token: ' CF_Token
3
echo
4
export CF_Token
5
export CF_Account_ID="你的Account_ID"
6

7
# 申请证书 (必须同时包含 Reality 直连域名和 CDN 回源域名，否则 Cloudflare 在“完全(严格)”模式下回源会报 526 证书错误)
8
$ACME --issue --dns dns_cf -d "reality.example.com" -d "cdn.example.com"

1
# 创建目录
2
mkdir -p /etc/caddy/certs
3

4
# 提取证书并设定重载命令
5
# 安装时只需要指定主域名（第一个 -d 域名），acme.sh 会自动关联
6
$ACME --install-cert -d "reality.example.com" \
7
--key-file       /etc/caddy/certs/reality.key \
8
--fullchain-file /etc/caddy/certs/reality.crt \
9
--reloadcmd     "chown caddy:caddy /etc/caddy/certs/reality.* && systemctl reload caddy"

1
# Caddy 日志目录
2
sudo mkdir -p /var/log/caddy
3
sudo chown -R caddy:caddy /var/log/caddy
4
sudo chmod 755 /var/log/caddy
5

6
# 证书文件
7
ls -la /etc/caddy/certs/
8
# 应显示 -rw-r--r-- 1 caddy caddy reality.crt
9
# 应显示 -rw------- 1 caddy caddy reality.key
10

11
# 若属主不是 caddy，请执行修正：
12
sudo chown -R caddy:caddy /var/log/caddy
13
sudo chown caddy:caddy /etc/caddy/certs/reality.*
14
sudo chmod 640 /etc/caddy/certs/reality.key

1
sudo systemctl enable --now xray caddy

1
systemctl show xray --property=User,Group
2
systemctl show caddy --property=User,Group
3
ls -l /run/xray/ /run/caddy/

1
User=caddy
2
Group=
3

4
---
5

6
User=caddy
7
Group=caddy
8

9
# /run/xray/
10
srwxr-xr-x 1 caddy caddy 0 ... xhttp_in.sock
11
-rw-r--r-- 1 caddy caddy 0 ... xhttp_in.sock.lock
12

13
# /run/caddy/
14
s-w------- 1 caddy caddy 0 ... tls_gate.sock

1
# 检查是否有新版本
2
sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ check
3

4
# 升级到最新 Pre-release（推荐）
5
sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install --beta

1
sudo apt update
2
sudo apt upgrade caddy -y