fix v2ray links

app/i18n.php

@@ -262,8 +262,8 @@ $i = [
         'ru' => 'очистить',
     ],
     'xray'  => [
-        'en' => 'Sing-box',
+        'en' => 'Xray',
-        'ru' => 'Sing-box',
+        'ru' => 'Xray',
     ],
     'geodb'  => [
         'en' => 'GeoIp/GeoSite',

config/nginx.conf

@@ -2,6 +2,7 @@ user  nginx;
 worker_processes  auto;
 
 error_log  /logs/nginx_error;
+pid        /var/run/nginx.pid;
 
 events {
     worker_connections  1024;
@@ -21,8 +22,8 @@ http {
   set_real_ip_from    10.10.0.10;
 
   server {
-    listen 80 default_server;
+    listen 10.10.0.2:80 default_server;
-    listen 443 ssl http2 default_server proxy_protocol;
+    listen 10.10.0.2:443 ssl http2 default_server proxy_protocol;
     ssl_certificate /certs/self_public;
     ssl_certificate_key /certs/self_private;
 
@@ -63,6 +64,17 @@ http {
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
     }
+    location /ws {
+        proxy_pass http://xr:443;
+        proxy_redirect off;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_read_timeout 5d;
+    }
     location ~\.well-known {
       access_log /logs/nginx_certbot_access;
       root /certs/;
@@ -74,11 +86,12 @@ http {
 
 #-domain
   # server {
-  #   listen 80;
+  #   listen 10.10.0.2:80;
   #   server_name ;
 #-domain
 #-ssl
-    # listen 443 ssl http2 proxy_protocol;
+    # listen 10.10.0.2:443 ssl http2 proxy_protocol;
+    # listen 10.10.1.2:443 ssl http2;
     # ssl_certificate /certs/cert_public;
     # ssl_certificate_key /certs/cert_private;
 #-ssl
@@ -122,6 +135,17 @@ http {
   #     proxy_set_header Upgrade $http_upgrade;
   #     proxy_set_header Connection "upgrade";
   #   }
+  #   location /ws {
+  #       proxy_pass http://xr:443;
+  #       proxy_redirect off;
+  #       proxy_http_version 1.1;
+  #       proxy_set_header Upgrade $http_upgrade;
+  #       proxy_set_header Connection "upgrade";
+  #       proxy_set_header Host $host;
+  #       proxy_set_header X-Real-IP $remote_addr;
+  #       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  #       proxy_read_timeout 5d;
+  #    }
 #-domain
 #-ssl
   #   # The DoH server block

config/nginx_default.conf

@@ -2,6 +2,7 @@ user  nginx;
 worker_processes  auto;
 
 error_log  /logs/nginx_error;
+pid        /var/run/nginx.pid;
 
 events {
     worker_connections  1024;
@@ -21,8 +22,8 @@ http {
   set_real_ip_from    10.10.0.10;
 
   server {
-    listen 80 default_server;
+    listen 10.10.0.2:80 default_server;
-    listen 443 ssl http2 default_server proxy_protocol;
+    listen 10.10.0.2:443 ssl http2 default_server proxy_protocol;
     ssl_certificate /certs/self_public;
     ssl_certificate_key /certs/self_private;
 
@@ -63,6 +64,17 @@ http {
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
     }
+    location /ws {
+        proxy_pass http://xr:443;
+        proxy_redirect off;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_read_timeout 5d;
+    }
     location ~\.well-known {
       access_log /logs/nginx_certbot_access;
       root /certs/;
@@ -74,11 +86,12 @@ http {
 
 #-domain
   # server {
-  #   listen 80;
+  #   listen 10.10.0.2:80;
   #   server_name ;
 #-domain
 #-ssl
-    # listen 443 ssl http2 proxy_protocol;
+    # listen 10.10.0.2:443 ssl http2 proxy_protocol;
+    # listen 10.10.1.2:443 ssl http2;
     # ssl_certificate /certs/cert_public;
     # ssl_certificate_key /certs/cert_private;
 #-ssl
@@ -122,6 +135,17 @@ http {
   #     proxy_set_header Upgrade $http_upgrade;
   #     proxy_set_header Connection "upgrade";
   #   }
+  #   location /ws {
+  #       proxy_pass http://xr:443;
+  #       proxy_redirect off;
+  #       proxy_http_version 1.1;
+  #       proxy_set_header Upgrade $http_upgrade;
+  #       proxy_set_header Connection "upgrade";
+  #       proxy_set_header Host $host;
+  #       proxy_set_header X-Real-IP $remote_addr;
+  #       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  #       proxy_read_timeout 5d;
+  #    }
 #-domain
 #-ssl
   #   # The DoH server block

config/pac.json

@@ -1,3 +1,99 @@
 {
-    "includelist": []
+    "zapret": false,
+    "excludelist": {
+        "(?:v|w)ul(?:c|k)an": true,
+        "^\\d": true,
+        "^a\\w-": true,
+        "^admiral": true,
+        "^avtomaty": true,
+        "^azart": true,
+        "^azimob": true,
+        "^baltplay": true,
+        "a(?:s|z)ino": true,
+        "adrenalin": true,
+        "alco": true,
+        "bet": true,
+        "prostitut": true,
+        "zenit": true,
+        "zerkalo": true,
+        "777": true
+    },
+    "includelist": {},
+    "reverselist": {},
+    "subzoneslist": {
+        "3dn": false,
+        "3nx": true,
+        "akadns": true,
+        "appspot": true,
+        "azurewebsites": true,
+        "beget": true,
+        "berlogovo": true,
+        "biz": true,
+        "brightcove": true,
+        "cc": true,
+        "cloudfront": true,
+        "co": true,
+        "com": true,
+        "cu": true,
+        "ddns": true,
+        "deviantart": true,
+        "dn": true,
+        "dp": true,
+        "dyndns": true,
+        "edgecastcdn": true,
+        "edu": true,
+        "eu": true,
+        "fastly": true,
+        "force": true,
+        "github": true,
+        "google": true,
+        "googleusercontent": true,
+        "gov": true,
+        "herokuapp": true,
+        "hldns": true,
+        "ho": true,
+        "hopto": true,
+        "hwcdn": true,
+        "i": true,
+        "iboards": true,
+        "in": true,
+        "info": true,
+        "int": true,
+        "itch": true,
+        "keenetic": true,
+        "kiev": true,
+        "kirov": true,
+        "linode": true,
+        "livejournal": true,
+        "maryno": true,
+        "mil": true,
+        "msk": true,
+        "my1": true,
+        "mybb2": true,
+        "ne": true,
+        "net": true,
+        "netdna-ssl": true,
+        "nnov": true,
+        "notion": true,
+        "nov": true,
+        "od": true,
+        "org": true,
+        "pp": true,
+        "pximg": true,
+        "pythonanywhere": true,
+        "ru": true,
+        "scaleway": true,
+        "sl": true,
+        "sl-reverse": true,
+        "spb": true,
+        "tilda": true,
+        "trafficmanager": true,
+        "tut": true,
+        "u-stream": true,
+        "ucoz": true,
+        "v": true,
+        "vercel": true,
+        "wix": true,
+        "wixmp": true
+    }
 }

config/sing.json

@@ -54,10 +54,54 @@
                 "detour": "direct"
             }
         ],
+        "rules": [
+            {
+                "outbound": "any",
+                "server": "dns-direct",
+                "disable_cache": false
+            }
+        ],
         "strategy": "ipv4_only",
         "independent_cache": true
     },
-    "outbounds": [],
+    "outbounds": [
+        {
+            "flow": "xtls-rprx-vision",
+            "packet_encoding": "",
+            "server": "",
+            "server_port": 443,
+            "tls": {
+                "enabled": true,
+                "insecure": false,
+                "reality": {
+                    "enabled": true,
+                    "public_key": "",
+                    "short_id": ""
+                },
+                "server_name": "",
+                "utls": {
+                    "enabled": true,
+                    "fingerprint": "chrome"
+                }
+            },
+            "uuid": "",
+            "type": "vless",
+            "domain_strategy": "ipv4_only",
+            "tag": "proxy"
+        },
+        {
+            "type": "direct",
+            "tag": "direct"
+        },
+        {
+            "type": "block",
+            "tag": "block"
+        },
+        {
+            "type": "dns",
+            "tag": "dns-out"
+        }
+    ],
     "route": {
         "auto_detect_interface": true,
         "override_android_vpn": true,

config/singbox.json

@@ -1,26 +0,0 @@
-{
-    "inbounds": [],
-    "log": {
-        "level": "info"
-    },
-    "outbounds": [
-        {
-            "type": "direct",
-            "tag": "direct"
-        },
-        {
-            "type": "block",
-            "tag": "block"
-        },
-        {
-            "type": "socks",
-            "tag": "warp",
-            "server": "10.10.0.13",
-            "server_port": 4000
-        }
-    ],
-    "route" : {
-        "rules": [],
-        "final": "direct"
-    }
-}

config/upstream.conf

@@ -15,12 +15,8 @@ stream {
         server ng:443;
     }
 
-    upstream si {
+    upstream reality {
-        server si:443;
+        server xr:443;
-    }
-
-    upstream singbox {
-        server 127.0.0.1:4443;
     }
 
     upstream ocserv {
@@ -34,7 +30,7 @@ stream {
     map_hash_bucket_size 128;
     map $ssl_preread_server_name $sni_name {
         #domain
-        vk.com singbox;
+        www.microsoft.com reality;
         #domain
 
         #ocserv
@@ -47,22 +43,17 @@ stream {
         default other;
     }
 
-    server {
-        listen          4443 reuseport proxy_protocol;
-        proxy_pass      si;
-    }
-
     server {
         listen          443 reuseport;
         proxy_pass      $sni_name;
-        ssl_preread     on;
         proxy_protocol  on;
+        ssl_preread     on;
     }
 
     server {
         listen          443 udp;
         proxy_pass      $sni_name;
-        ssl_preread     on;
         proxy_protocol  on;
+        ssl_preread     on;
     }
 }

config/xray.json

@@ -0,0 +1,61 @@
+{
+    "inbounds": [
+        {
+            "port": 443,
+            "protocol": "vless",
+            "settings": {
+                "clients": [
+                ],
+                "decryption": "none"
+            },
+            "sniffing": {
+                "destOverride": [
+                    "http",
+                    "tls"
+                ],
+                "enabled": true
+            },
+            "streamSettings": {
+                "network": "tcp",
+                "realitySettings": {
+                    "dest": "www.microsoft.com:443",
+                    "maxClientVer": "",
+                    "maxTimeDiff": 0,
+                    "minClientVer": "",
+                    "privateKey": "",
+                    "serverNames": [
+                        "www.microsoft.com"
+                    ],
+                    "shortIds": [],
+                    "show": false,
+                    "xver": 0
+                },
+                "tcpSettings": {
+                    "acceptProxyProtocol": true
+                },
+                "sockopt": {
+                    "acceptProxyProtocol": true
+                },
+                "security": "reality"
+            },
+            "tag": "vless_tls"
+        }
+    ],
+    "log": {
+        "loglevel": "info"
+    },
+    "outbounds": [
+        {
+            "protocol": "freedom",
+            "tag": "direct"
+        },
+        {
+            "protocol": "blackhole",
+            "tag": "block"
+        }
+    ],
+    "routing": {
+        "domainStrategy": "AsIs",
+        "rules": []
+    }
+}

docker-compose.yml

@@ -10,6 +10,10 @@ networks:
         ipam:
             config:
                 - subnet: 10.10.0.0/24
+    xray:
+        ipam:
+            config:
+                - subnet: 10.10.1.0/24
 volumes:
     adguard:
 
@@ -23,9 +27,9 @@ services:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
+            - ./config/upstream.conf:/etc/nginx/nginx.conf
             - ./scripts/start_upstream.sh:/start_upstream.sh
             - ./ssh:/ssh
-            - ./config:/config
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./logs/:/logs/
         ports:
@@ -59,7 +63,9 @@ services:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
-            - ./config:/config
+            - ./config/nginx.conf:/etc/nginx/nginx.conf
+            - ./config/include.conf:/etc/nginx/include.conf
+            - ./config/nginx_default.conf:/nginx_default.conf
             - ./scripts/start_ng.sh:/start_ng.sh
             - ./certs/:/certs/
             - ./ssh:/ssh
@@ -83,6 +89,8 @@ services:
         networks:
             default:
                 ipv4_address: 10.10.0.2
+            xray:
+                ipv4_address: 10.10.1.2
         logging: *default-logging
     php:
         image: mercurykd/vpnbot-php:1.5
@@ -179,7 +187,7 @@ services:
             - ad
             - ss
             - tg
-            - si
+            - xr
             - oc
             - np
     proxy:
@@ -390,21 +398,20 @@ services:
             default:
                 ipv4_address: 10.10.0.8
         logging: *default-logging
-    si:
+    xr:
-        image: mercurykd/vpnbot-sb:1.2
+        image: mercurykd/vpnbot-xr:1.3
         build:
-            dockerfile: dockerfile/singbox.dockerfile
+            dockerfile: dockerfile/xray.dockerfile
             args:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
-            - ./config:/config
+            - ./config/xray.json:/xray.json
-            - ./certs:/certs
+            - ./scripts/start_xray.sh:/start_xray.sh
-            - ./scripts/start_sing.sh:/start_sing.sh
+        hostname: xray
-        hostname: singbox
+        container_name: xray-${VER}
-        container_name: singbox-${VER}
         depends_on:
             php:
                 condition: service_healthy
@@ -414,10 +421,12 @@ services:
             - path: ./override.env
               required: false
         stop_grace_period: 1s
-        command: ["/bin/sh", "/start_sing.sh"]
+        command: ["/bin/sh", "/start_xray.sh"]
         networks:
             default:
                 ipv4_address: 10.10.0.9
+            xray:
+                ipv4_address: 10.10.1.9
         logging: *default-logging
     oc:
         image: mercurykd/vpnbot-oc:1.2

dockerfile/singbox.dockerfile

@@ -1,9 +0,0 @@
-ARG image
-FROM $image
-RUN apk add openssh openssl jq \
-    && mkdir /root/.ssh \
-    && wget https://github.com/SagerNet/sing-box/releases/download/v1.9.3/sing-box-1.9.3-linux-amd64.tar.gz \
-    && tar -xf sing-box-1.9.3-linux-amd64.tar.gz \
-    && mv sing-box-1.9.3-linux-amd64/sing-box /usr/bin \
-    && rm sing-box-1.9.3-linux-amd64.tar.gz \
-    && rm -rf /sing-box-1.9.3-linux-amd64

dockerfile/xray.dockerfile

@@ -0,0 +1,12 @@
+ARG image
+FROM $image
+RUN apk add openssh openssl jq \
+    && mkdir /root/.ssh \
+    && wget -O Xray-linux-64.zip $(wget -q -O - https://api.github.com/repos/XTLS/Xray-core/releases/latest | grep browser_download_url | cut -d\" -f4 | egrep 'Xray-linux-64.zip$') \
+    && unzip Xray-linux-64.zip \
+    && mv xray /usr/bin/ \
+    && rm Xray-linux-64.zip \
+    && rm geoip.dat \
+    && rm geosite.dat \
+    && chmod +x /usr/bin/xray
+ENV ENV="/root/.ashrc"

makefile

@@ -36,8 +36,8 @@ proxy: # консоль сервиса
 	docker compose exec proxy /bin/sh
 tg: # консоль сервиса
 	docker compose exec tg /bin/sh
-si: # консоль сервиса
+xr: # консоль сервиса
-	docker compose exec si /bin/sh
+	docker compose exec xr /bin/sh
 oc: # консоль сервиса
 	docker compose exec oc /bin/sh
 clean:

scripts/start_ng.sh

@@ -1,8 +1,8 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-sed "s/ss:[0-9]\+/ss:$SSPORT/" /config/nginx_default.conf > change_port
+sed "s/ss:[0-9]\+/ss:$SSPORT/" /nginx_default.conf > change_port
-cat change_port > /config/nginx_default.conf
+cat change_port > /nginx_default.conf
-sed "s/ss:[0-9]\+/ss:$SSPORT/" /config/nginx.conf > change_port
+sed "s/ss:[0-9]\+/ss:$SSPORT/" /etc/nginx/nginx.conf > change_port
-cat change_port > /config/nginx.conf
+cat change_port > /etc/nginx/nginx.conf
-nginx -g "daemon off;" -c /config/nginx.conf
+nginx -g "daemon off;"

scripts/start_sing.sh

@@ -1,5 +0,0 @@
-cat /ssh/key.pub > /root/.ssh/authorized_keys
-ssh-keygen -A
-exec /usr/sbin/sshd -D -e "$@" &
-sing-box run -c /config/singbox.json > /dev/null &
-tail -f /dev/null

scripts/start_upstream.sh

@@ -1,4 +1,4 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-nginx -g "daemon off;" -c /config/upstream.conf
+nginx -g "daemon off;"

scripts/start_xray.sh

@@ -0,0 +1,8 @@
+cat /ssh/key.pub > /root/.ssh/authorized_keys
+ssh-keygen -A
+exec /usr/sbin/sshd -D -e "$@" &
+if [ $(cat /xray.json | jq -r '.inbounds[0].settings.clients[0].id' | wc -c) -gt 1 ]
+then
+    xray run -config /xray.json > /dev/null &
+fi
+tail -f /dev/null

version

@@ -1,3 +1,12 @@
+03.09.2024 v1.46.2
+- fix link v2ray
+03.09.2024 v1.46.1
+- fix import
+- fix websocket domain
+03.09.2024 v1.46
+- возможность добавить кастомный поддомен для Letsencrypt
+03.09.2024 v1.45
+- выбор транспорта reality/websocket
 26.08.2024 v1.44
 - qr для xtls
 - фикс действий на элементом списков