vless+ws+tls+cloudflare+nginx 配置记录

233boy 一键xray脚本

bash <(wget -qO- -o- https://github.com/233boy/Xray/raw/main/install.sh)

域名接入CLoudflare 开启CDN加速 SSL/TLS配置选择灵活

服务器上

xray no-auto-tls VLESS-WS-TLS www.baidu.com

配合acme.sh 申请相关域名证书 申请证书貌似需要关闭CDN加速

配置nginx

server {
    listen 80;
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name www.baidu.com;
    #HTTP_TO_HTTPS_START
    #if ($server_port !~ 443){
    #    rewrite ^(/.*)$ https://$host$1 permanent;
    #}
    #HTTP_TO_HTTPS_END
    root html;
    index index.php index.html index.htm;
    ssl_certificate    ssl/www.baidu.com/fullchain.cer;
    ssl_certificate_key    ssl/www.baidu.com/xray.climberser.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # 在 location 后填写 /你的 path
    location /xxxx {
    if ($http_upgrade != "websocket") {
        return 404;
    }
        proxy_pass http://127.0.0.1:99999;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 5d;
    }
}