- 两个不同的一级domain：a.com（翻墙/伪装站点），b.com（website）；
- 所以利用nginx sni分流复用443端口（非采用xray的fallback sni分流）；
- 优点：xray and website 在配置上独立互不影响
- 此处文章不用bt panel
- 全新系统root角色：ubuntu20.04、Debian10
- domain已进行dns servername解析
- 如果只有一个domain只安装翻墙服务，建议使用一键脚本
一、安装环境
1、升级系统
apt update & apt upgrade -y
# 若为debian10，又是非root，则需要安装sudo
apt install sudo -y
apt-get install software-properties-common
2、更换内核为xanmod
# 参考：https://xanmod.org
# Add the repository:
echo 'deb http://deb.xanmod.org releases main' | sudo tee /etc/apt/sources.list.d/xanmod-kernel.list
# GPG key
wget -qO - https://dl.xanmod.org/gpg.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/xanmod-kernel.gpg add -
# Then update and install
sudo apt update && sudo apt install linux-xanmod-edge
# xanmod内核已经默认开启bbr
3、安装nginx
a、ubuntu20.04安装nginx
# 透过添加ppa安装最新版，而非系统源
# 参考：https://launchpad.net/~ondrej/+archive/ubuntu/nginx-mainline
sudo add-apt-repository ppa:ondrej/nginx-mainline
sudo apt-get update
apt install nginx
b、debian10安装nginx
# 参考：https://nginx.org/en/linux_packages.html#Debian
apt install curl gnupg2 ca-certificates lsb-release
# To set up the apt repository for mainline nginx packages
echo "deb http://nginx.org/packages/mainline/debian `lsb_release -cs` nginx" \
| sudo tee /etc/apt/sources.list.d/nginx.list
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" \
| sudo tee /etc/apt/preferences.d/99nginx
curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
sudo mv /tmp/nginx_signing.key /etc/apt/trusted.gpg.d/nginx_signing.asc
sudo apt update
sudo apt install nginx
二、申请ssl证书
# 参考：https://guide.v2fly.org/advanced/tls.html#%E4%BD%BF%E7%94%A8-acme-sh-%E7%94%9F%E6%88%90%E8%AF%81%E4%B9%A6
apt-get install openssl cron socat curl unzip
# 安装 acme.sh
curl https://get.acme.sh | sh
# 使用acem.sh生成证书，会自动更新
service nginx stop #防止nginx占用80端口
~/.acme.sh/acme.sh --issue -d a.com --standalone --keylength ec-256 --force
# 安装证书到/etc/nginx/ssl
mkdir /etc/nginx/ssl
~/.acme.sh/acme.sh --installcert -d a.com --ecc \
--fullchain-file /etc/nginx/ssl/a.crt \
--key-file /etc/nginx/ssl/a.key
# 手动更新证书
~/.acme.sh/acme.sh --renew -d a.com --force --ecc
# 申请b.com如上述a.com步骤
三、安装xray
参考：https://github.com/XTLS/Xray-install
# install & upgrade（user为root）
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install -u root
# remove xray
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ remove --purge
四、配置
1、nginx.conf配置
# 打开编辑nginx.conf
nano /etc/nginx/nginx.conf
# 添加以下代码到最后一个 `}` 之前
# backend_name 随便改写，但要一致
# xtls web1 随便改写，但要一致
stream {
map $ssl_preread_server_name $backend_name {
a.com xtls;
b.com web1;
default web;
}
upstream xtls {
server 127.0.0.1:10240;
}
upstream web1 {
server 127.0.0.1:10241;
}
server {
listen 443 reuseport;
listen [::]:443 reuseport;
proxy_pass $backend_name;
ssl_preread on;
}
}
2、xray伪装站点a.com nginx配置
# 添加伪站
mkdir /etc/nginx/html
cd /etc/nginx/html
wget https://github.com/V2RaySSR/Trojan/raw/master/web.zip
unzip web.zip
# 伪站配置 a.com nginx
nano /etc/nginx/conf.d/a.conf
# 添加如下代码
server
{
listen 80;
server_name a.com;
return 301 https://$http_host$request_uri;
}
server {
listen 127.0.0.1:8089 default_server;
root /etc/nginx/html;
index index.php index.html index.htm default.php default.htm default.html;
add_header Strict-Transport-Security "max-age=63072000" always;
}
3.website b.com nginx配置
nano /etc/nginx/conf.d/b.conf
# 添加如下代码
server
{
listen 80;
server_name b.com;
return 301 https://$http_host$request_uri;
}
server
{
listen 10241 ssl;
server_name b.com;
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/b.com;
ssl_certificate /etc/nginx/ssl/a.crt;
ssl_certificate_key /etc/nginx/ssl/a.key;
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=63072000" always;
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
}
}
4、xray服务端配置
//以下是vless+tcp+xtls & trojan & vmess+websocket+tls
//透过vless的fallback，所以服务地址都是a.com
//各种翻墙配置模版，参考：https://github.com/XTLS/Xray-examples/tree/main/VLESS-TCP-XTLS-WHATEVER
nano /usr/local/etc/xray/config.json
# 添加以下代码
{
"log": {
"loglevel": "none"
},
"inbounds": [
//vless+xtls
{
"port": 10240,
"protocol": "vless",
"settings": {
"clients": [
{
"id": "uuid",
"flow": "xtls-rprx-direct",
"level": 0,
"email": "amdin@a.com"
}
],
"decryption": "none",
"fallbacks": [
{
"dest": 13457, //默认fallback到trojan
"xver": 1
},
{
"path": "/wdeewls", //wss
"dest": 28237,
"xver": 1
}
]
},
"streamSettings": {
"network": "tcp",
"security": "xtls",
"xtlsSettings": {
"allowInsecure": false,
"alpn": [
"http/1.1"
],
"minVersion": "1.3",
"certificates": [
{
"certificateFile": "/etc/nginx/ssl/a.crt",
"keyFile": "/etc/nginx/ssl/a.key"
}
]
}
}
},
{
"port": 13457,
"listen": "127.0.0.1",
"protocol": "trojan",
"settings": {
"clients": [
{
"password": "22nHxabht30CfqA",
"level": 0,
"email": "admin@a.com"
}
],
"fallbacks": [
{
"dest": 8089 //fallback端口
}
]
},
"streamSettings": {
"network": "tcp",
"security": "none",
"tcpSettings": {
"acceptProxyProtocol": true
}
}
},
{
"port": 28237,
"listen": "127.0.0.1",
"protocol": "vmess",
"settings": {
"clients": [
{
"id": "uuid",
"level": 0,
"alterId": 0,
"email": "admin@admin.com"
}
]
},
"streamSettings": {
"network": "ws",
"security": "none",
"wsSettings": {
"acceptProxyProtocol": true,
"path": "/wdeewls"
}
}
}
],
"outbounds": [
{
"protocol": "freedom"
}
]
}
5、重启相关服务
service nginx restart
systemctl restart xray