# July 20

    https://timharbakon.com/vless-reality-xhttp-proxy/

Tim Harbakon

VLESS Reality + XHTTP Proxy Setup on Linux VPS

Configure VLESS with Reality protocol on Linux. Includes TCP+Vision and XHTTP configs. Traffic looks like normal HTTPS to DPI.

January 31, 2026

Cars driving through a tunnel, 
blending into traffic — a metaphor for proxy traffic hiding in plain sight.

Introduction
VLESS with Reality protocol makes proxy traffic indistinguishable from normal HTTPS connections. Deep packet inspection (DPI) cannot differentiate it from regular browsing because Reality mimics a real TLS handshake with a legitimate website.

Prerequisites
VPS with port 443 open
Ubuntu/Debian
1. Install Xray-core
sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
2. Generate Credentials and Get Server IP
Run these commands and save the output. Values are referenced as <PLACEHOLDER> in later sections.

xray uuid                # <UUID>
xray x25519              # PrivateKey → <PRIVATE_KEY>, Password → <PUBLIC_KEY>
openssl rand -hex 8      # <SHORT_ID>
curl -4 ifconfig.me      # <SERVER_IP>
Password in xray output is actually the public key (confusing naming). Never share your <PRIVATE_KEY>.

3. Choose SNI (Server Name Indication)
Reality works by mimicking TLS connections to a real website. The SNI you choose must meet these requirements:

Supports TLS 1.3 and HTTP/2
Geographically close to your VPS (same region/datacenter)
Not behind Cloudflare CDN
Common options: www.microsoft.com, www.apple.com, www.yahoo.com

For advanced users: RealiTLScanner can find domains in your VPS’s datacenter.

4. Server Configuration
sudo nano /usr/local/etc/xray/config.json
Choose one option:

TCP + Vision — hides TLS-in-TLS patterns from DPI, widely supported
XHTTP — newer transport, fragments data across HTTP requests, more resistant to traffic analysis
Configs below use www.microsoft.com as default. If you chose a different SNI in Section 3, update dest, serverNames, and the client URLs.

Option A: TCP + Vision
{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "<UUID>",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "www.microsoft.com:443",
          "xver": 0,
          "serverNames": ["www.microsoft.com"],
          "privateKey": "<PRIVATE_KEY>",
          "shortIds": ["<SHORT_ID>"]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"]
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    }
  ]
}
Option B: XHTTP Config
{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "<UUID>"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "path": "/xh"
        },
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "www.microsoft.com:443",
          "xver": 0,
          "serverNames": ["www.microsoft.com"],
          "privateKey": "<PRIVATE_KEY>",
          "shortIds": ["<SHORT_ID>"]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"]
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    }
  ]
}
5. Start Xray
sudo systemctl enable xray
sudo systemctl status xray
View logs: sudo journalctl -u xray -f

Open port 443 on your VPS firewall if not already open.

After config changes, restart Xray:

sudo systemctl restart xray
6. Client Connection URL
Import these URLs into your client app. Replace placeholders with your values.

TCP + Vision:

vless://<UUID>@<SERVER_IP>:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.microsoft.com&fp=chrome&pbk=<PUBLIC_KEY>&sid=<SHORT_ID>&type=tcp#reality-tcp
XHTTP:

vless://<UUID>@<SERVER_IP>:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=<PUBLIC_KEY>&sid=<SHORT_ID>&type=xhttp&path=/xh#reality-xhttp
7. Client App
Happ — available for iOS, Android, macOS, Windows, Linux, and TV. Built on Xray core with XHTTP support.

Happ app showing VLESS Reality connection
Happ client with imported VLESS Reality config

8. QR Code (Optional)
Generate a QR code for easy mobile import:

sudo apt install qrencode -y   # Debian/Ubuntu
brew install qrencode          # macOS
qrencode -o vless-tcp.png "vless://<UUID>@<SERVER_IP>:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.microsoft.com&fp=chrome&pbk=<PUBLIC_KEY>&sid=<SHORT_ID>&type=tcp#reality-tcp"
Scan the QR code with your client app to import the config.


# geph5

## 2254pm

build from ~/repo/geph5/

# Test if geph5 status can reach the manager
$ /home/za/repo/geph5/target/release/geph5 status 2>&1
Error: could not reach the geph manager — is it running? start it with `sudo geph5 manager`
+ Thought: 10.9s
Not directly. The geph5 CLI talks to a manager daemon (sudo geph5 manager), which isn't running. gephgui-wry is a standalone Flatpak app with its own embedded client — it doesn't expose the manager protocol.
Options to monitor status
Your standalone geph5-client (if still running on port 19913 control):

# Restart it in background first
RUST_LOG=geph5=info /home/za/repo/geph5/target/release/geph5-client -c ~/.config/geph5/config.yaml &

# Then query directly via the SQLite log DB

sqlite3 /home/za/.cache/geph5-client/cache.db "SELECT json FROM logs ORDER BY id DESC LIMIT 10"
Query the GUI's control port (try port 12222 or 5678 — gephgui-wry likely exposes the same control protocol on one of these):

# Try conn_info RPC via netcat (JSON-RPC over TCP)

echo '{"jsonrpc":"2.0","method":"conn_info","params":[],"id":1}' | nc -w2 127.0.0.1 12222
Or use the full manager stack so geph5 status works (requires root, replaces the GUI setup):
sudo ./target/release/geph5 manager      # start daemon
./target/release/geph5 login             # enter your secret
./target/release/geph5 connect           # bring tunnel up
./target/release/geph5 status            # now this works
But per your request to keep the GUI running, I'd recommend sticking with the standalone geph5-client in background + SQLite log monitoring.


# july 21

Chinese Prompts 

# 角色

你是一个专门帮助用户编写和理解 Xray-core 配置的助手。

你的任务是基于官方文档，帮助我解释配置项，或生成可使用的 Xray-core 配置文件。

# 唯一依据

请使用以下 Xray-core 官方全量文档作为唯一依据：

https://xtls.github.io/llms-full.txt

在回答任何配置相关问题前，请先打开并阅读该文档中的相关部分。

不要使用你的记忆、经验、社区模板、V2Ray 配置习惯、GitHub issue、博客文章或网上常见写法来判断字段是否存在或是否有效。

# 最重要的规则

不要编造配置字段。

只能使用官方文档中明确提到的字段、取值、默认值、限制条件和配置结构。

如果官方文档没有提到某个字段、取值、默认值、限制条件或组合方式，请直接回答：

“文档未提及，不能确认。”

不要猜测，不要补全，不要为了让配置看起来完整而添加没有文档依据的字段。

# 如果无法访问文档

如果你无法打开或读取官方文档链接，请直接说明：

“我无法访问官方文档链接，因此不能保证不产生幻觉。请手动下载 https://xtls.github.io/llms-full.txt 并上传给我，我会只基于上传文档回答。”

在无法访问官方文档时，不要根据记忆生成 Xray-core 配置，也不要根据记忆解释配置细节。

# 回答流程

回答任何配置相关问题时，请遵循以下流程：

1. 先阅读官方文档中的相关部分。
2. 找出相关的配置对象、字段、取值和限制条件。
3. 只基于文档明确确认的内容回答。
4. 如果某部分文档没有确认，请标记为“文档未提及，不能确认”。

生成配置时，请遵循以下流程：

1. 先确认你准备使用哪些字段。
2. 只用官方文档确认过的字段生成配置。
3. 输出前检查最终配置，删除任何无法由文档确认的字段。
4. 如果我的需求中有文档无法确认的部分，请放到“未确认内容”。

# 输出格式

默认输出 JSONC，也就是允许带 `//` 中文注释的 JSON 风格配置。

注释应该帮助普通用户理解：

- 这个字段做什么；
- 用户是否需要修改；
- 修改时要注意什么。

注释不能引入官方文档没有确认的功能。

如果我明确要求“纯 JSON”，请输出不带注释的合法 JSON。

不要使用 `_comment` 字段写注释，除非官方文档明确说支持这个字段。

# 生成配置时的回答格式

请使用以下格式：

## 文档依据

简要列出本次使用到的官方文档中的配置对象和关键字段。

## 配置文件

```jsonc
{
  // 在这里写配置
}
```

## 关键说明

解释我最需要修改或注意的字段。

## 未确认内容

列出我的需求中官方文档没有确认的部分。

如果没有未确认内容，请写：

“无。”

# 解释配置项时的回答格式

请使用以下格式：

## 结论

直接解释这个字段或配置对象的作用。

## 文档依据

说明它属于哪个官方文档中的配置对象，以及文档明确确认了什么。

## 注意事项

只写官方文档明确提到的限制、默认值、可选值或组合规则。

## 文档未提及

列出我的问题中官方文档没有确认的部分。