diff --git a/config/Caddyfile b/config/Caddyfile
index 9acffff..9985a85 100644
--- a/config/Caddyfile
+++ b/config/Caddyfile
@@ -1,5 +1,11 @@
 {
 	order forward_proxy before file_server
+	servers {
+		listener_wrappers {
+			proxy_protocol
+			tls
+		}
+	}
 }
 
 :443 {
diff --git a/config/nginx.conf b/config/nginx.conf
index e0f0d72..9f0e8d3 100644
--- a/config/nginx.conf
+++ b/config/nginx.conf
@@ -17,9 +17,13 @@ http {
   # Proxy Cache storage - so we can cache the DoH response from the upstream
   proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m;
 
+  real_ip_header      proxy_protocol;
+  real_ip_recursive   on;
+  set_real_ip_from    10.10.0.10;
+
   server {
     listen 80 default_server;
-    listen 443 ssl http2 default_server;
+    listen 443 ssl http2 default_server proxy_protocol;
     ssl_certificate /certs/self_public;
     ssl_certificate_key /certs/self_private;
 
@@ -75,7 +79,7 @@ http {
   #   server_name ;
 #-domain
 #-ssl
-    # listen 443 ssl http2;
+    # listen 443 ssl http2 proxy_protocol;
     # ssl_certificate /certs/cert_public;
     # ssl_certificate_key /certs/cert_private;
 #-ssl
diff --git a/config/nginx_default.conf b/config/nginx_default.conf
index 31d5303..9f0e8d3 100644
--- a/config/nginx_default.conf
+++ b/config/nginx_default.conf
@@ -22,8 +22,8 @@ http {
   set_real_ip_from    10.10.0.10;
 
   server {
-    listen 10.10.0.2:80 default_server;
-    listen 10.10.0.2:443 ssl http2 default_server proxy_protocol;
+    listen 80 default_server;
+    listen 443 ssl http2 default_server proxy_protocol;
     ssl_certificate /certs/self_public;
     ssl_certificate_key /certs/self_private;
 
@@ -75,12 +75,11 @@ http {
 
 #-domain
   # server {
-  #   listen 10.10.0.2:80;
+  #   listen 80;
   #   server_name ;
 #-domain
 #-ssl
-    # listen 10.10.0.2:443 ssl http2 proxy_protocol;
-    # listen 10.10.1.2:443 ssl http2;
+    # listen 443 ssl http2 proxy_protocol;
     # ssl_certificate /certs/cert_public;
     # ssl_certificate_key /certs/cert_private;
 #-ssl
diff --git a/config/ocserv.conf b/config/ocserv.conf
index 6d5e403..edf822b 100644
--- a/config/ocserv.conf
+++ b/config/ocserv.conf
@@ -203,7 +203,7 @@ max-same-clients = 2
 # the TCP or UNIX socket (not the UDP one). Although both v1
 # and v2 versions of proxy protocol are supported, the v2 version
 # is recommended as it is more efficient in parsing.
-listen-proxy-proto = false
+listen-proxy-proto = true
 
 # Rate limit the number of incoming connections to one every X milliseconds
 # (X is the provided value), as the secmod backlog grows. This
diff --git a/config/upstream.conf b/config/upstream.conf
index 57a41da..2004de4 100644
--- a/config/upstream.conf
+++ b/config/upstream.conf
@@ -15,10 +15,14 @@ stream {
         server ng:443;
     }
 
-    upstream singbox {
+    upstream si {
         server si:443;
     }
 
+    upstream singbox {
+        server 127.0.0.1:4443;
+    }
+
     upstream ocserv {
         server oc:443;
     }
@@ -43,15 +47,22 @@ stream {
         default other;
     }
 
+    server {
+        listen          4443 reuseport proxy_protocol;
+        proxy_pass      si;
+    }
+
     server {
         listen          443 reuseport;
         proxy_pass      $sni_name;
         ssl_preread     on;
+        proxy_protocol  on;
     }
 
     server {
         listen          443 udp;
         proxy_pass      $sni_name;
         ssl_preread     on;
+        proxy_protocol  on;
     }
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index 765766c..06e4764 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -23,9 +23,9 @@ services:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
-            - ./config/upstream.conf:/etc/nginx/nginx.conf
             - ./scripts/start_upstream.sh:/start_upstream.sh
             - ./ssh:/ssh
+            - ./config:/config
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./logs/:/logs/
         ports:
@@ -59,9 +59,7 @@ services:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
-            - ./config/nginx.conf:/etc/nginx/nginx.conf
-            - ./config/include.conf:/etc/nginx/include.conf
-            - ./config/nginx_default.conf:/nginx_default.conf
+            - ./config:/config
             - ./scripts/start_ng.sh:/start_ng.sh
             - ./certs/:/certs/
             - ./ssh:/ssh
diff --git a/scripts/start_ng.sh b/scripts/start_ng.sh
index ba224fb..c2b4b96 100644
--- a/scripts/start_ng.sh
+++ b/scripts/start_ng.sh
@@ -1,8 +1,8 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-sed "s/ss:[0-9]\+/ss:$SSPORT/" /nginx_default.conf > change_port
-cat change_port > /nginx_default.conf
-sed "s/ss:[0-9]\+/ss:$SSPORT/" /etc/nginx/nginx.conf > change_port
-cat change_port > /etc/nginx/nginx.conf
-nginx -g "daemon off;"
+sed "s/ss:[0-9]\+/ss:$SSPORT/" /config/nginx_default.conf > change_port
+cat change_port > /config/nginx_default.conf
+sed "s/ss:[0-9]\+/ss:$SSPORT/" /config/nginx.conf > change_port
+cat change_port > /config/nginx.conf
+nginx -g "daemon off;" -c /config/nginx.conf
diff --git a/scripts/start_upstream.sh b/scripts/start_upstream.sh
index 57c40bf..4771cc3 100644
--- a/scripts/start_upstream.sh
+++ b/scripts/start_upstream.sh
@@ -1,4 +1,4 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-nginx -g "daemon off;"
+nginx -g "daemon off;" -c /config/upstream.conf