Skip to content

Commit f2d68d5

Browse files
author
clovep
committed
install xray and trojan-go caddy
1 parent ce268c2 commit f2d68d5

File tree

2 files changed

+393
-0
lines changed

2 files changed

+393
-0
lines changed

‎auto_caddy.sh‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/usr/bin/env bash
2+
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
3+
export PATH
4+
# Usage: debian 9/10 one_key naiveproxy： https://github.com/klzgrad/naiveproxy
5+
# install: bash <(curl -s https://raw.githubusercontent.com/mixool/across/master/naiveproxy/naiveproxy.sh) my.domain.com
6+
# uninstall: apt purge caddy -y
7+
8+
# tempfile & rm it when exit
9+
trap 'rm -f "$TMPFILE"' EXIT
10+
TMPFILE=$(mktemp) || exit 1
11+
12+
########
13+
[[ $# == 1 ]] && domain="$1" || { echo Err !!! Useage: bash this_script.sh my.domain.com; exit 1; }
14+
########
15+
16+
# dpkg install caddy
17+
caddyURL="$(wget -qO- https://api.github.com/repos/caddyserver/caddy/releases | grep -E "browser_download_url.*linux_amd64\.deb" | cut -f4 -d\" | head -n1)"
18+
wget -O $TMPFILE $caddyURL && dpkg -i $TMPFILE
19+
20+
# xcaddy build caddy with layer4 cloudflare-dns forwardproxy weekly automatic updates: https://github.com/mixool/caddys
21+
naivecaddyURL="https://github.com/mixool/caddys/raw/master/caddy"
22+
rm -rf /usr/bin/caddy
23+
wget --no-check-certificate -O /usr/bin/caddy $naivecaddyURL && chmod +x /usr/bin/caddy
24+
25+
# secrets
26+
username="$(tr -dc 'a-z0-9A-Z' </dev/urandom | head -c 16)"
27+
password="$(tr -dc 'a-z0-9A-Z' </dev/urandom | head -c 16)"
28+
probe_resistance="$(tr -dc 'a-z0-9' </dev/urandom | head -c 32).com"
29+
30+
# config caddy json
31+
cat <<EOF >/etc/caddy/Caddyfile
32+
http://$domain:80 {
33+
redir https://$domain{uri}
34+
}
35+
http://$domain:8080 {
36+
bind 127.0.0.1
37+
route {
38+
forward_proxy {
39+
basic_auth user $2
40+
hide_ip
41+
hide_via
42+
probe_resistance unsplash.com:443
43+
upstream http://127.0.0.1:8081
44+
}
45+
file_server { root /var/www/html }
46+
}
47+
}
48+
EOF
49+
50+
# systemctl service info
51+
echo; echo $(date) caddy status:
52+
systemctl daemon-reload && systemctl enable caddy && systemctl restart caddy && sleep 1 && systemctl status caddy | more | grep -A 2 "caddy.service"
53+
54+
# info
55+
echo; echo $(date); echo username: $username; echo password: $password; echo probe_resistance: $probe_resistance; echo proxy: https://$username:$password@$domain

‎auto_install.sh‎

Lines changed: 338 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,338 @@
1+
#!/usr/bin/env bash
2+
#install xray
3+
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
4+
mkdir /usr/local/etc/trojan-go/
5+
mkdir /root/mine/renew/domain_certificate
6+
mkdir /root/mine/telegram
7+
read -p "请输入域名:" domain
8+
read -p "该服务器名称(Euserv2):" server_name
9+
uuid_xtls="$(cat '/proc/sys/kernel/random/uuid')"
10+
uuid_ws="$(cat '/proc/sys/kernel/random/uuid')"
11+
trojan_passwd="$(cat '/proc/sys/kernel/random/uuid' | sed -e 's/-//g' | tr '[:upper:]' '[:lower:]' | head -c $((10+$RANDOM%10)))"
12+
path_vless="/$(cat '/proc/sys/kernel/random/uuid' | sed -e 's/-//g' | tr '[:upper:]' '[:lower:]' | head -c $((10+$RANDOM%10)))"
13+
path_trojan="/$(cat '/proc/sys/kernel/random/uuid' | sed -e 's/-//g' | tr '[:upper:]' '[:lower:]' | head -c $((10+$RANDOM%10)))"
14+
#xray config
15+
cat > /usr/local/etc/xray/config.json <<-EOF
16+
{
17+
"log": {
18+
"loglevel": "warning"
19+
},
20+
"inbounds": [
21+
{
22+
"port": 443,
23+
"protocol": "vless",
24+
"settings": {
25+
"clients": [
26+
{
27+
"id": "$uuid_xtls",
28+
"flow": "xtls-rprx-direct",
29+
"level": 0,
30+
"email": "love@example.com"
31+
}
32+
],
33+
"decryption": "none",
34+
"fallbacks": [
35+
{
36+
"dest": "3567"
37+
},
38+
{
39+
"path": "$path_trojan",
40+
"dest": "3567"
41+
},
42+
{
43+
"path": "$path_vless",
44+
"dest": 1234,
45+
"xver": 1
46+
}
47+
]
48+
},
49+
"streamSettings": {
50+
"network": "tcp",
51+
"security": "xtls",
52+
"xtlsSettings": {
53+
"minVersion": "1.2",
54+
"alpn": [
55+
"http/1.1"
56+
],
57+
"certificates": [
58+
{
59+
"certificateFile": "/usr/local/etc/xray/ssl/fullchain.pem",
60+
"keyFile": "/usr/local/etc/xray/ssl/privkey.pem"
61+
}
62+
]
63+
}
64+
}
65+
},
66+
{
67+
"port": 1234,
68+
"listen": "127.0.0.1",
69+
"protocol": "vless",
70+
"settings": {
71+
"clients": [
72+
{
73+
"id": "$uuid_ws",
74+
"level": 0,
75+
"email": "love@example.com"
76+
}
77+
],
78+
"decryption": "none"
79+
},
80+
"streamSettings": {
81+
"network": "ws",
82+
"security": "none",
83+
"wsSettings": {
84+
"acceptProxyProtocol": true,
85+
"path": "$path_vless"
86+
}
87+
}
88+
}
89+
],
90+
"outbounds":
91+
[
92+
{"protocol": "freedom","tag": "direct","settings": {}},
93+
{"protocol": "freedom","tag": "directv6","settings": {"domainStrategy": "UseIPv6"}},
94+
{"protocol": "blackhole","tag": "blocked","settings": {}},
95+
{"protocol": "freedom","tag": "twotag","streamSettings": {"network": "domainsocket","dsSettings": {"path": "/usr/local/etc/xray/ss","abstract": true}}}
96+
],
97+
98+
"routing":
99+
{
100+
"rules":
101+
[
102+
{"type": "field","outboundTag": "directv6","domain": ["geosite:netflix","geosite:google","geosite:youtube"]},
103+
{"type": "field","inboundTag": ["onetag"],"outboundTag": "twotag"},
104+
{"type": "field","outboundTag": "blocked","ip": ["geoip:private"]},
105+
{"type": "field","outboundTag": "blocked","domain": ["geosite:private","geosite:category-ads-all"]}
106+
]
107+
}
108+
}
109+
EOF
110+
#ssl certificate
111+
apt install certbot
112+
certbot certonly --standalone --email cqlp2020@gmail.com -d $domain
113+
cp /etc/letsencrypt/live/$domain/* /usr/local/etc/xray/ssl/
114+
systemctl restart xray
115+
#download website template
116+
wget https://github.com/cqlp1314/storage/raw/main/html.tar.gz
117+
tar -xzvf html.tar.gz
118+
mkdir -p /var/www/html
119+
mv var/www/html/* /var/www/html/*
120+
rm -r var/
121+
#install and configure caddy
122+
./auto_caddy.sh $domain $trojan_passwd
123+
#download trojan-go
124+
wget -O /usr/local/etc/trojan-go/trojan-go-linux-adm64.zip https://github.com/p4gefau1t/trojan-go/releases/download/v0.8.2/trojan-go-linux-amd64.zip
125+
unzip /usr/local/etc/trojan-go/trojan-go-linux-adm64.zip trojan-go -d /usr/local/etc/trojan-go/
126+
rm /usr/local/etc/trojan-go/trojan-go-linux-adm64.zip
127+
#configure trojan-go
128+
cat > /etc/systemd/system/trojan-go.service <<-EOF
129+
[Unit]
130+
Description=Trojan-Go - An unidentifiable mechanism that helps you bypass GFW
131+
Documentation=https://p4gefau1t.github.io/trojan-go/
132+
After=network.target nss-lookup.target
133+
134+
[Service]
135+
User=nobody
136+
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
137+
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
138+
NoNewPrivileges=true
139+
ExecStart=/usr/local/etc/trojan-go/trojan-go -config /usr/local/etc/trojan-go/server.json
140+
Restart=on-failure
141+
RestartSec=10s
142+
143+
[Install]
144+
WantedBy=multi-user.target
145+
EOF
146+
cat > /usr/local/etc/trojan-go/server.json <<-EOF
147+
{
148+
"run_type": "server",
149+
"local_addr": "127.0.0.1",
150+
"local_port": 3567,
151+
"remote_addr": "127.0.0.1",
152+
"remote_port": 8080,
153+
"log_level": 3,
154+
"password": [
155+
"$trojan_passwd"
156+
],
157+
"transport_plugin": {
158+
"enabled": true,
159+
"type": "plaintext"
160+
},
161+
"websocket": {
162+
"enabled": true,
163+
"path": "$path_trojan",
164+
"host": "$domain"
165+
},
166+
"router": {
167+
"enabled": false
168+
}
169+
}
170+
EOF
171+
systemctl daemon-reload
172+
systemctl enable trojan-go
173+
systemctl start trojan-go
174+
#crontab renew certificate twice every month and send message to telegram
175+
wget -O /root/mine/renew/domain_certificate/renew.sh https://raw.githubusercontent.com/cqlp1314/storage/main/renew.sh
176+
wget -O /root/mine/telegram/send_message.sh https://raw.githubusercontent.com/cqlp1314/storage/main/send_message.sh
177+
chmod +x /root/mine/telegram/send_message.sh /root/mine/renew/domain_certificate/renew.sh
178+
(crontab -l 2>/dev/null;echo "0 0 5,20 * * cd /root/mine/renew/domain_certificate; ./renew.sh $server_name > log.txt 2>&1")|crontab -
179+
echo "uuid_xtls: $uuid_xtls"
180+
echo "uuid_ws: $uuid_ws"
181+
echo "trojan_passwd: $trojan_passwd"
182+
echo "path_vless: $path_vless"
183+
echo "path_trojan: $path_trojan"
184+
ws_remote_addr="icook.tw"
185+
cat > trojan-go_client.json <<-EOF
186+
{
187+
"run_type": "client",
188+
"local_addr": "127.0.0.1",
189+
"local_port": 41155,
190+
"remote_addr": "$ws_remote_addr",
191+
"remote_port": 443,
192+
"password": [
193+
"$trojan_passwd"
194+
],
195+
"ssl": {
196+
"sni": "$domain"
197+
},
198+
"mux": {
199+
"enabled": false,
200+
"concurrency":8,
201+
"idle_timeout":60
202+
},
203+
"router": {
204+
"enabled": false,
205+
"bypass": [
206+
"geoip:cn",
207+
"geoip:private",
208+
"geosite:cn",
209+
"geosite:geolocation-cn"
210+
],
211+
"block": [
212+
"geosite:category-ads"
213+
],
214+
"proxy": [
215+
"geosite:geolocation-!cn"
216+
],
217+
"default_policy": "proxy",
218+
"geoip": "/usr/share/trojan-go/geoip.dat",
219+
"geosite": "/usr/share/trojan-go/geosite.dat"
220+
},
221+
"websocket":{
222+
"enabled":true,
223+
"path":"\$path_trojan",
224+
"host":"$domain"
225+
}
226+
}
227+
EOF
228+
cat > xray_ws.json <<-EOF
229+
{
230+
"log": {
231+
"loglevel": "warning"
232+
},
233+
"inbounds": [
234+
{
235+
"port": 10807,
236+
"listen": "127.0.0.1",
237+
"protocol": "socks",
238+
"settings": {
239+
"udp": true
240+
}
241+
}
242+
],
243+
"outbounds": [
244+
{
245+
"protocol": "vless",
246+
"settings": {
247+
"vnext": [
248+
{
249+
"address": "$ws_remote_addr", // 换成你的域名或服务器 IP（发起请求时无需解析域名了）
250+
"port": 443,
251+
"users": [
252+
{
253+
"id": "$uuid_ws", // 填写你的 UUID
254+
"encryption": "none",
255+
"level": 0
256+
}
257+
]
258+
}
259+
]
260+
},
261+
"streamSettings": {
262+
"network": "ws",
263+
"security": "tls",
264+
"tlsSettings": {
265+
"serverName": "$domain" // 换成你的域名
266+
},
267+
"wsSettings": {
268+
"connectionReuse": true,
269+
"path": "$path_vless",
270+
"headers": {
271+
"Host": "$domain"
272+
}
273+
},
274+
"mux": {
275+
"enabled": false,
276+
"concurrency": 8
277+
}
278+
}
279+
}
280+
]
281+
}
282+
EOF
283+
cat > xray_xtls.json <<-EOF
284+
{
285+
"log": {
286+
"loglevel": "warning"
287+
},
288+
"inbounds": [
289+
{
290+
"port": 10800,
291+
"listen": "127.0.0.1",
292+
"protocol": "socks",
293+
"settings": {
294+
"udp": true
295+
}
296+
}
297+
],
298+
"outbounds": [
299+
{
300+
"protocol": "vless",
301+
"settings": {
302+
"vnext": [
303+
{
304+
"address": "$domain", // 换成你的域名或服务器 IP（发起请求时无需解析域名了）
305+
"port": 443,
306+
"users": [
307+
{
308+
"id": "$uuid_xtls", // 填写你的 UUID
309+
"flow": "xtls-rprx-direct",
310+
"encryption": "none",
311+
"level": 0
312+
}
313+
]
314+
}
315+
]
316+
},
317+
"streamSettings": {
318+
"network": "tcp",
319+
"security": "xtls", // 需要使用 XTLS
320+
"xtlsSettings": {
321+
"serverName": "$domain" // 换成你的域名
322+
}
323+
}
324+
}
325+
]
326+
}
327+
EOF
328+
echo "trojan-go client configuration"
329+
cat trojan-go_client.json
330+
echo ""
331+
echo "xray-ws client configuration"
332+
cat xray_ws.json
333+
echo "xray-xtls client configuration"
334+
cat xray_xtls.json
335+
rm trojan-go_client.json xray_ws.json xray_xtls.json
336+
337+
338+

0 commit comments

Comments
 (0)