Xray VLESS + XHTTP + TLS Relay, WARP: 2-Server Setup This article provides a technical guide for setting up a two-server Xray proxy configuration using VLESS, XHTTP, and TLS Reality protocols. Server A acts as an inbound relay that accepts client connections via XHTTP with Reality encryption, then forwards traffic to Server B using another VLESS+XHTTP+TLS connection. The guide includes step-by-step installation commands, configuration file examples with placeholder values, and instructions for generating the necessary cryptographic keys and UUIDs. gistfile1.txt This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters Show hidden characters СЕРВЕР А Всё ставим sudo apt update sudo apt install -y curl nano jq bash -c "$ curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh " @ install -u root Всё генерируем с помощью xray uuid - ИД xray x25519 - ключи xray vlessenc - для шифрования openssl rand -hex 8 - short id В итоге потребуется: CLIENT UUID A REALITY PRIVATE KEY A REALITY PUBLIC KEY A REALITY SHORT ID CLIENT TO A DECRYPTION CLIENT TO A ENCRYPTION A TO B UUID A TO B DECRYPTION A TO B ENCRYPTION Конфиг xray, сервер А vim /usr/local/etc/xray/config.json Пример { "log": { "access": "/var/log/xray/access.log", "error": "/var/log/xray/error.log", "loglevel": "warning" }, "dns": { "servers": "1.1.1.1", "8.8.8.8" , "queryStrategy": "UseIPv4" }, "inbounds": { "tag": "client-xhttp-reality-in", "listen": "0.0.0.0", "port": 443, "protocol": "vless", "settings": { "clients": { "id": "CLIENT UUID", "email": "main-client", "flow": "xtls-rprx-vision" } , "decryption": "CLIENT TO A DECRYPTION" }, "streamSettings": { "network": "xhttp", "security": "reality", "xhttpSettings": { "path": "/assets", "mode": "stream-one" }, "realitySettings": { "show": false, "dest": "www.microsoft.com:443", "xver": 0, "serverNames": "www.microsoft.com" , "privateKey": "A REALITY PRIVATE KEY", "shortIds": "A REALITY SHORT ID" } }, "sniffing": { "enabled": true, "destOverride": "http", "tls", "quic" } }, { "tag": "local-test-socks", "listen": "127.0.0.1", "port": 10808, "protocol": "socks", "settings": { "udp": true } } , "outbounds": { "tag": "relay-b", "protocol": "vless", "settings": { "vnext": { "address": "api.catandmouseteam.xyz", "port": 443, "users": { "id": "A TO B UUID", "encryption": "A TO B ENCRYPTION", "flow": "xtls-rprx-vision", "packetEncoding": "xudp" } } }, "streamSettings": { "network": "xhttp", "security": "tls", "tlsSettings": { "serverName": "api.catandmouseteam.xyz", "alpn": "h2", "http/1.1" , "fingerprint": "chrome" }, "xhttpSettings": { "path": "/assets", "mode": "stream-one" }, "sockopt": { "domainStrategy": "UseIPv4" } } }, { "tag": "direct", "protocol": "freedom", "settings": { "domainStrategy": "UseIPv4" } }, { "tag": "block", "protocol": "blackhole" } , "routing": { "rules": { "type": "field", "inboundTag": "client-xhttp-reality-in", "local-test-socks" , "outboundTag": "relay-b" } } } Запуск sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json sudo systemctl enable --now xray sudo systemctl restart xray СЕРВЕР Б, ставим xray sudo apt update sudo apt install -y curl jq debian-keyring debian-archive-keyring apt-transport-https ca-certificates gnupg bash -c "$ curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh " @ install -u root Сервер Б, ставим caddy curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \ | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \ | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list sudo apt update sudo apt install -y caddy Получаем данные WARP bash -c "$ curl -L warp-reg.vercel.app " Нужно: private key - WARP SECRET KEY public key - WARP PUBLIC KEY reserved dec - WARP RESERVED endpoint.v4 - WARP ENDPOINT v4 - WARP ADDRESS vim /usr/local/etc/xray/config.json Пример конфига { "log": { "access": "/var/log/xray/access.log", "error": "/var/log/xray/error.log", "loglevel": "warning" }, "dns": { "servers": "1.1.1.1", "8.8.8.8" , "queryStrategy": "UseIPv4" }, "inbounds": { "tag": "vless-xhttp-from-a", "listen": "127.0.0.1", "port": 10085, "protocol": "vless", "settings": { "clients": { "id": "A TO B UUID", "email": "server-a", "flow": "xtls-rprx-vision" } , "decryption": "A TO B DECRYPTION" }, "streamSettings": { "network": "xhttp", "security": "none", "xhttpSettings": { "path": "/assets", "mode": "stream-one" } }, "sniffing": { "enabled": true, "destOverride": "http", "tls", "quic" } } , "outbounds": { "tag": "warp", "protocol": "wireguard", "settings": { "secretKey": "WARP SECRET KEY", "address": "WARP ADDRESS/32" , "peers": { "publicKey": "WARP PUBLIC KEY", "allowedIPs": "0.0.0.0/0" , "endpoint": "WARP ENDPOINT:2408", "keepAlive": 25 } , "reserved": 0, 0, 0 , "mtu": 1280, "domainStrategy": "ForceIPv4", "noKernelTun": true } }, { "tag": "direct", "protocol": "freedom", "settings": { "domainStrategy": "UseIPv4" } }, { "tag": "block", "protocol": "blackhole" } , "routing": { "rules": { "type": "field", "inboundTag": "vless-xhttp-from-a" , "outboundTag": "warp" } } } Запускаем sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json sudo systemctl enable --now xray sudo systemctl restart xray Конфиг caddy, сервер Б vim /etc/caddy/Caddyfile Пример api.catandmouseteam.xyz { encode gzip zstd handle /assets { reverse proxy 127.0.0.1:10085 { flush interval -1 transport http { versions h2c 1.1 } } } handle /healthz { header Content-Type application/json respond {"status":"ok","service":"api-gateway"} 200 } handle { root /usr/share/caddy/api file server } } Можно сделать страницу-заглушку типа sudo mkdir -p /usr/share/caddy/api sudo tee /usr/share/caddy/api/index.html /dev/null <<'HTML' < doctype html