{"id":15110142,"url":"https://github.com/aleskxyz/reality-ezpz","last_synced_at":"2025-04-13T08:56:43.228Z","repository":{"id":153416198,"uuid":"629039520","full_name":"aleskxyz/reality-ezpz","owner":"aleskxyz","description":"Install sing-box/xray and configure vless / tuic / hysteria2 / shadowtls for reality or tls (letsencrypt) over different transport protocols (tcp, http, grpc and websocket) with user management capability in CLI, TUI and Telegram bot by a single command in docker compose!","archived":false,"fork":false,"pushed_at":"2024-10-20T14:41:33.000Z","size":221,"stargazers_count":1271,"open_issues_count":26,"forks_count":194,"subscribers_count":20,"default_branch":"master","last_synced_at":"2025-04-06T05:08:52.841Z","etag":null,"topics":["bash","cdn","cloudflare","docker","docker-compose","grpc","hysteria2","letsencrypt","qrcode","reality","shadowtls","sing-box","telegram-bot","tls","tuic","user-management","vless","warp","websocket","xray"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aleskxyz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-04-17T13:50:00.000Z","updated_at":"2025-04-06T00:15:54.000Z","dependencies_parsed_at":"2023-12-02T01:23:54.542Z","dependency_job_id":"5d219e80-be46-4ea3-b91e-6c7c8c424373","html_url":"https://github.com/aleskxyz/reality-ezpz","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aleskxyz%2Freality-ezpz","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aleskxyz%2Freality-ezpz/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aleskxyz%2Freality-ezpz/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aleskxyz%2Freality-ezpz/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aleskxyz","download_url":"https://codeload.github.com/aleskxyz/reality-ezpz/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248688544,"owners_count":21145764,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bash","cdn","cloudflare","docker","docker-compose","grpc","hysteria2","letsencrypt","qrcode","reality","shadowtls","sing-box","telegram-bot","tls","tuic","user-management","vless","warp","websocket","xray"],"created_at":"2024-09-25T23:41:49.707Z","updated_at":"2025-04-13T08:56:43.195Z","avatar_url":"https://github.com/aleskxyz.png","language":"Shell","funding_links":[],"categories":["🚀 Xray / XTLS"],"sub_categories":[],"readme":"# reality-ezpz\nInstall and configure vless with reality or TLS on your linux server by executing a single command!\n\nTUIC and hysteria2 on sing-box is also supported!\n\nThis script:\n* Installs docker with compose plugin in your server\n* Generates docker-compose.yml and sing-box/xray configuration for vless protocol for reality and tls\n* Generates docker-compose.yml and sing-box configuration for TUIC protocol with tls\n* Generates docker-compose.yml and sing-box configuration for hysteria2 protocol with tls\n* Create Cloudflare warp account and configure warp as outbound\n* Generates client configuration string and QRcode\n* Gets and renews valid certificate from Letsencrypt for TLS encryption\n* Fine-tunes kernel tunables\n* Is designed by taking security considerations into account  to make the server undetectable\n* Provides a Telegram bot to manage users from Telegram\n\nFeatures:\n* Generates client configuration string\n* Generates client configuration QRcode\n* You can choose between xray or sing-box core\n* You can choose between reality or TLS security protocol\n* You can use a Text-based user interface (TUI)\n* You can create multiple user accounts\n* You can regenerate configuration and keys\n* You can change SNI domain\n* You can change transport protocol (tcp, http, grpc, ws)\n* You can change tunneling protocol (vless, TUIC, hysteria2, shadowtls)\n* You can get valid TLS certificate with Letsencrypt\n* You can block malware and adult contents\n* Merges your custom advanced configuration\n* Use Cloudflare WARP to hide your outbound traffic\n* Supports Cloudflare warp+\n* Install with a single command\n* Telegram bot for user management\n* Create backup from users and configuration\n* Restore users and configuration from backup\n\nSupported OS:\n* Ubuntu 22.04\n* Ubuntu 20.04\n* Ubuntu 18.04\n* Debian 11\n* Debian 10\n* CentOS Stream 9\n* CentOS Stream 8\n* CentOS 7\n* Fedora 37\n\n## Quick Start\nYou can start using this script with default configuration by copy and paste the line below in terminal.\n\nThis command will configure `sing-box` with `reality` security protocol over `tcp` transport protocol on port `443` for `www.google.com` SNI domain by default:\n```\nbash \u003c(curl -sL https://bit.ly/realityez)\n```\nor (if the above command dosen't work):\n```\nbash \u003c(curl -sL https://raw.githubusercontent.com/aleskxyz/reality-ezpz/master/reality-ezpz.sh)\n```\nAfter a while you will get configuration string and QR code:\n![image](https://user-images.githubusercontent.com/39186039/232563871-0140e10a-22b4-4653-9bc9-cdba519a8b41.png)\n\nYou can run TUI with `-m` or `--menu` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -m\n```\nAnd then you will see management menu in your terminal:\n![image](https://github.com/aleskxyz/reality-ezpz/assets/39186039/a727148c-1a11-4702-80f3-ab8b46d916af)\n\nYou can also enable Telegram bot with `--enable-tgbot` option and manage users from with your Telegram bot ([More Info](#telegram-bot))\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://github.com/aleskxyz/reality-ezpz/assets/39186039/7e31383a-e00b-426e-9324-6d58f36e7da0\" width=\"300\"\u003e\n\u003c/p\u003e\n\nHelp message of the script:\n```\n\nUsage: reality-ezpz.sh [-t|--transport=tcp|http|grpc|ws|tuic|hysteria2|shadowtls] [-d|--domain=\u003cdomain\u003e] [--server=\u003cserver\u003e]\n  [--regenerate] [--default] [-r|--restart] [--enable-safenet=true|false] [--port=\u003cport\u003e] [-c|--core=xray|sing-box]\n  [--enable-warp=true|false] [--warp-license=\u003clicense\u003e] [--security=reality|letsencrypt|selfsigned] [-m|--menu]\n  [--show-server-config] [--add-user=\u003cusername\u003e] [--lists-users] [--show-user=\u003cusername\u003e] [--delete-user=\u003cusername\u003e]\n  [--backup] [--restore=\u003curl|file\u003e] [--backup-password=\u003cpassword\u003e] [-u|--uninstall]\n\n  -t, --transport \u003ctcp|http|grpc|ws|tuic|hysteria2|shadowtls\u003e Transport protocol (tcp, http, grpc, ws, tuic, hysteria2, shadowtls default: tcp)\n  -d, --domain \u003cdomain\u003e     Domain to use as SNI (default: www.google.com)\n      --server \u003cserver\u003e     IP address or domain name of server (Must be a valid domain if using letsencrypt security)\n      --regenerate          Regenerate public and private keys\n      --default             Restore default configuration\n  -r  --restart             Restart services\n  -u, --uninstall           Uninstall reality\n      --enable-safenet \u003ctrue|false\u003e Enable or disable safenet (blocking malware and adult content)\n      --port \u003cport\u003e         Server port (default: 443)\n      --enable-warp \u003ctrue|false\u003e Enable or disable Cloudflare warp\n      --warp-license \u003cwarp-license\u003e Add Cloudflare warp+ license\n  -c  --core \u003csing-box|xray\u003e Select core (xray, sing-box, default: sing-box)\n      --security \u003creality|letsencrypt|selfsigned\u003e Select type of TLS encryption (reality, letsencrypt, selfsigned, default: reality)\n  -m  --menu                Show menu\n      --enable-tgbot \u003ctrue|false\u003e Enable Telegram bot for user management\n      --tgbot-token \u003ctoken\u003e Token of Telegram bot\n      --tgbot-admins \u003ctelegram-username\u003e Usernames of telegram bot admins (Comma separated list of usernames without leading '@')\n      --show-server-config  Print server configuration\n      --add-user \u003cusername\u003e Add new user\n      --list-users          List all users\n      --show-user \u003cusername\u003e Shows the config and QR code of the user\n      --delete-user \u003cusername\u003e Delete the user\n      --backup              Backup users and configuration and upload it to temp.sh\n      --restore \u003curl|file\u003e  Restore backup from URL or file\n      --backup-password \u003cpassword\u003e Create/Restore password protected backup file\n  -h, --help                Display this help message\n```\n\n## Clients\n- Android\n  - [v2rayNG](https://github.com/2dust/v2rayNg/releases)\n  - [NekoBox](https://github.com/MatsuriDayo/NekoBoxForAndroid/releases)\n- iOS\n  - [FoXray](https://apps.apple.com/app/foxray/id6448898396)\n  - [Shadowrocket](https://apps.apple.com/app/shadowrocket/id932747118)\n  - [Stash](https://apps.apple.com/app/stash/id1596063349)\n- Windows\n  - [v2rayN](https://github.com/2dust/v2rayN/releases)\n- Windows, Linux, macOS\n  - [NekoRay](https://github.com/MatsuriDayo/nekoray/releases)\n  - [Furious](https://github.com/LorenEteval/Furious/releases)\n\n## Security Options\nThis script can configure the service with 3 types of security options:\n- reality\n- letsencrypt\n- selfsigned\n\nBy default `reality` is configured but you can change the security protocol with `--security` option.\n\nThe `letsencrypt` option will use Letsencrypt to get a valid certificate for you server. So you have to assign a valid domain or subdomain to your server with `--server \u003cdomain\u003e` option.\n\nThe `selfsigned` option is same as `letsencrypt` but the certificates are self-signed and you don't need to assign a domain or subdomain to your server.\n\n## Compatibility and recommendation\nCDN compatibility table:\n\n|   | Cloudflare | ArvanCloud |\n| ------------ | ------------ | ------------ |\n| reality | :x: | :x: |\n| selfsigned | :heavy_check_mark: | :heavy_check_mark: |\n| letsencrypt | :heavy_check_mark: | :heavy_check_mark: |\n| tcp  | :x:  | :x:  |\n| http  | :x:  | :heavy_check_mark:  |\n| grpc  | :heavy_check_mark:  | :heavy_check_mark:  |\n| ws  | :heavy_check_mark:  | :heavy_check_mark:  |\n| tuic  | :x:  | :x:  |\n| hysteria2  | :x:  | :x:  |\n| shadowtls  | :x:  | :x:  |\n\n- You need to enable `grpc` or `websocket` in Cloudflare if you want to use the corresponding transport protocols.\n- You have to configure CDN provider to use HTTPS for connecting to your server.\n- The `ws` transport protocol is not compatible with `reality` security option.\n- The `tuic` tunneling protocol is not compatible with `reality` security option.\n- The `tuic` tunneling protocol is only compatible with `sing-box` core option.\n- The `hysteria2` tunneling protocol is not compatible with `reality` security option.\n- The `hysteria2` tunneling protocol is only compatible with `sing-box` core option.\n- The `shadowtls` tunneling protocol is only compatible with `sing-box` core option.\n- Avoid using `tcp` transport protocol with `letsencrypt` or `selfsigned` security options.\n- Avoid using `selfsigned` security option. Get a domain and use `letsencrypt` option.\n- Do not change the port to something other than `443`.\n- The `sing-box` core has better performance.\n- Using [NekoBox](https://github.com/MatsuriDayo/NekoBoxForAndroid/releases) for Android is recommended.\n\n## User Management\nYou can add, view and delete multiple user account with this script easily!\n\n### Add User\nYou can add additional user by using `--add-user` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --add-user user1\n```\nThis command will create `test1` as a new user.\n\nNotice: Username can only contains A-Z, a-z and 0-9\n\n### List Users\nYou can view a list of all users by using `--list-users` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --list-users\n```\n\n### Show User Configuration\nYou can get config string and QR code of the user for importing by using `--show-user` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --show-user user1\n```\nThis command will print config string and QR code of `user1`\n\n### Delete User\nYou can delete a user by using `--delete-user` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --delete-user user1\n```\nThis command will delete `user1`\n\n## Advanced Configuration\nYou can change script defaults by using different arguments.\n\nYour configuration will be saved and restored in each execution. So You can run the script multiple time with out any problem.\n\n### Change SNI domain\nReality protocol will use the public certificate of SNI domain.\n\nDefault SNI domain is `www.google.com`.\n\nYou can change it by using `--domain` or `-d` options:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -d yahoo.com\n```\n### Change transport protocol\nDefault transport protocol is `tcp`.\n\nYou can change it by using `--transport` or `-t` options:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -t http\n```\nValid options are `tcp`,`http`, `grpc`, `ws`, `tuic`, `hysteria2` and `shadowtls`.\n\n`ws` is not compatible with reality protocol. You have to use `letsencrypt` or `selfsigned` with it.\n\n`tuic` is not compatible with reality protocol. You have to use `letsencrypt` or `selfsigned` with it.\n\n`tuic` is compatible with sing-box core only.\n\n`hysteria2` is not compatible with reality protocol. You have to use `letsencrypt` or `selfsigned` with it.\n\n`hysteria2` is compatible with sing-box core only.\n\n`shadowtls` is compatible with sing-box core only.\n\n#### ShadowTLS\nShadowTLS is a TLS disguise proxy that can use someone else's trusted certificate. It is similar to \"Reality,\" but in transport, it uses Shadowsocks. So you need to assign a working SNI to it.\n\nWhen you enable ShadowTLS, you will configure two proxies: ShadowTLS and Shadowsocks.\n\nYou need to configure your client to use both proxies in chain mode.\n\nFirst, ShadowTLS will establish a secure connection with the server, then Shadowsocks will use the connection created by ShadowTLS.\n\n### Block malware and adult contents\nYou can block malware and adult contents by using `--enable-safenet` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --enable-safenet true\n```\nYou can disable this feature with `--enable-safenet false` option.\n\n### Get runnig configuration\nYou can get the running configuration with `--show-server-config` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --show-server-config\n```\n\n### Regenerate configuration keys\nYou can regenerate keys by using `--regenerate` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --regenerate\n```\nAll other configuration will be same as before.\n\n### Restart services\nYou can restart the service by using `-r` or `--restart` options:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -r\n```\n\n### Restore default configuration\nYou can restore default configuration by using `--default` option.\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --default\n```\nUser account will not change with this option.\n\n### Uninstall\nYou can delete configuration and services by using `--uninstall` or `-u` options:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -u\n```\n\n### Change port\nNotice: Do not change default port. This may block your IP!\n\nDefault port is `443`.\n\nIn case of using `letsencrypt` security option, port `80` has to be available for Letsencrypt challenge.\n\nYou can change it by using `--port` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --port 8443\n```\n\n### Change engine core\nDefault engine core is sing-box but you can also switch to xray by using `--core` or `-c` options:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -c xray\n```\nValid options are `xray` and `sing-box`.\n\n### Create backup\nYou can create a backup from users and configuration and upload it to https://temp.sh/ by using `--backup` option.\n\nThe `--backup-password` option allows you to protect the backup zip file with the specified password. (Optional)\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --backup --backup-password \"P@ssw0rd\"\n```\nThis command will give you a URL to download you backup file. The URL is only valid for 3 days.\n\n### Restore backup\nYou can restore a previously created backup file with `--restore` option.\n\nYou need to give the path or URL of the backup file to restore.\n\nThe `--backup-password` option allows you to restore the password protected backup zip file.\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --restore /path/to/backup.zip --backup-password \"P@ssw0rd\"\n```\nor\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --restore \"https://www.example.com/backup.zip\" --backup-password \"P@ssw0rd\"\n```\n\nYou can migrate users and configuration from one server to another by:\n\n1. Create backup in the old server and copy the URL of backup file\n1. Restore the URL of backup file in the new server\n\n### Text-based user interface (TUI)\nYou can also use the TUI for changing the configuration of the service.\n\nTo access to TUI you can use `-m` or `--menu` options:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) -m\n```\n\n## Telegram Bot\nYou can manage users with Telegram Bot.\n\nYou should get a Telegram bot token from `@BotFather` Telegram account.\n\nThen you can enable Telegram bot by using this command as an example:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --enable-tgbot true --tgbot-token \u003ctelegram-bot-token\u003e --tgbot-admins=\u003cyour-telegram-username\u003e\n```\nIn the command above you have to provide a comma separated list of Telegram usernames (without leading '@') which are authorized to use Telegram bot.\n\nYou can disable Telegram bot with this command:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --enable-tgbot false\n```\n\n## Cloudflare WARP\nThis script uses official Cloudflare WARP client for connecting to Cloudflare network and send all outbound traffic to Cloudflare server. So your servers address will be masked by Cloudflare IPs. This gives you a better web surffing experience due to less captcha challenges and also resolves some websites limitations on your servers IP.\n\nYou can enable Cloudflare WARP by using `--enable-warp true` option. This script will create and register a free WAPR account and use it.\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --enable-warp true\n```\nFree account has traffic limitation and lower performance in comparison with WARP+ account which needs license.\n\nYou can either buy an WARP+ Unlimited license or get a free WARP+ license from this telegram bot: https://t.me/generatewarpplusbot\n\nAfter getting a license from that telegram bot, you can use the license for your server with `--warp-license` option:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --warp-license aaaaaaaa-bbbbbbbb-cccccccc\n```\nYou can use each warp+ license on 4 devices only.\n\nYou can disable Cloudflare WARP with `--enable-warp false`:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --enable-warp false\n```\n\n## Example\nYou can combine different options together.\n\nWe want to setup a server with these configurations:\n* `grpc` transport protocol\n* `www.wikipedia.org` as SNI domain\n* Block adult contents\n* Enable Cloudflare WARP\n* Set Cloudflare WARP+ license\n\nSo we need to execute this command:\n```\nbash \u003c(curl -sL https://bit.ly/realityez) --transport=grpc --domain=www.wikipedia.com --enable-safenet=true --enable-warp=true --warp-license=26z9i0ld-WG0wy324-rA703nZ2\n```\n## Custom Configuration\nUse this feature only if you know exactly what you are doing!\n\nYou can override the configuration generated by the script and add your own custom configuration to it.\n\nWrite your custom configuration in one of these files based on the engine that you are using:\n\n```\n/opt/reality-ezpz/sing-box.patch\n```\nor\n```\n/opt/reality-ezpz/xray.patch\n```\nAnd run script to apply your changes.\n\nFor example if you want to increase the debug level of sing-box engine, you can create `/opt/reality-ezpz/sing-box.patch` with this content:\n```\n{\n  \"log\": {\n    \"level\": \"debug\",\n    \"timestamp\": true\n  }\n}\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faleskxyz%2Freality-ezpz","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faleskxyz%2Freality-ezpz","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faleskxyz%2Freality-ezpz/lists"}