https://github.com/a-zuro/secret-sing-box
A script for full Sing-Box server setup with NGINX or HAProxy frontend
https://github.com/a-zuro/secret-sing-box
cdn haproxy multiplexing nginx proxy-chain proxy-server reverse-proxy sing-box trojan vless
Last synced: 4 months ago
JSON representation
A script for full Sing-Box server setup with NGINX or HAProxy frontend
- Host: GitHub
- URL: https://github.com/a-zuro/secret-sing-box
- Owner: A-Zuro
- License: mit
- Created: 2024-07-15T15:04:27.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2026-01-25T00:10:36.000Z (6 months ago)
- Last Synced: 2026-01-25T13:30:30.149Z (6 months ago)
- Topics: cdn, haproxy, multiplexing, nginx, proxy-chain, proxy-server, reverse-proxy, sing-box, trojan, vless
- Language: Shell
- Homepage:
- Size: 4.93 MB
- Stars: 200
- Watchers: 8
- Forks: 35
- Open Issues: 1
-
Metadata Files:
- Readme: .github/README-EN.md
- License: LICENSE
Awesome Lists containing this project
README
### Easy setup of a proxy with TLS termination on NGINX or HAProxy
This script is designed to fully and quickly configure a secure proxy server with [Sing-Box](https://sing-box.sagernet.org) core and [NGINX](https://nginx.org/en/) or [HAProxy](https://www.haproxy.org) frontend. To proxy traffic, **Trojan** and **VLESS** protocols are used. Two server setup options:
- All requests to the proxy are received by NGINX, the requests are passed to Sing-Box only if they contain the correct path (WebSocket or HTTPUpgrade transport)
- All requests to the proxy are received by HAProxy, then Trojan passwords are read from the first 56 bytes of the request by using a Lua script, the requests are passed to Sing-Box only if they contain the correct Trojan password (TCP transport) — [FPPweb3](https://github.com/FPPweb3) method
Both setup methods make it impossible to detect Sing-Box from the outside, which improves security.
> [!IMPORTANT]
> Supported OS for the server: Debian 11/12/13 or Ubuntu 22.04/24.04. Just 512 MB of RAM, 5 GB of disk space and 1 processor core are sufficient. You will also need an IPv4 on the server and your own domain/subdomain ([How to set it up?](cf-settings-en.md)). Run as root on a newly installed system. It's necessary to update and reboot the system before running this script.
> [!NOTE]
> With routing rules for Russia. Open ports on the server: 443 and SSH.
>
> This project is created for educational and demonstration purposes. Please make sure that your actions are legal before using it.
### Includes:
1) Sing-Box server setup (config for v1.12.0+)
2) NGINX or HAProxy reverse proxy and website setup on port 443
3) TLS certificates with auto renewal
4) Security setup (SSH, UFW and unattended-upgrades) — optional
5) Multiplexing to optimise connections and to solve TLS in TLS problem
6) Enable BBR
7) WARP setup
8) Optional setup of proxy chains of two or more servers
9) An option to setup connection to custom Cloudflare IP on the client
10) Client Sing-Box configs (v1.11.0–1.13.X) with routing rules for Russia
11) Automated management of user config files
12) Page for convenient distribution of subscriptions ([example](https://a-zuro.github.io/Secret-Sing-Box/sub.html#en))
### Server setup:
To setup the server, run this command on it:
```
bash <(curl -Ls https://raw.githubusercontent.com/A-Zuro/Secret-Sing-Box/master/Scripts/install-server.sh); source /etc/bash.bashrc
```
Then just enter the necessary information:
> [!CAUTION]
> Passwords, UUIDs, paths and other data in the image above are for example purposes only. Do not use them on your server.
In the end, the script will show your links to client configs and to subscription page, it's recommended to save them.
-----
To display the settings menu, run this command:
```
ssb
```
Then follow the instructions:
Option 5 synchronizes the settings in client configs of all users, which eliminates the need to edit the config of each user separately:
5.1. Synchronizes settings with the [template from GitHub](../Config-Templates/client.json).
5.2. Synchronizes settings with the local template, allows to set custom rules in client configs. If new rule sets are added to the configs by using this option, they will be automatically downloaded on the server if they are from [SagerNet](https://github.com/SagerNet/sing-geosite/tree/rule-set).
### WARP+ keys:
To activate a WARP+ key, enter this command (replace the key with yours):
```
warp-cli registration license CMD5m479-Y5hS6y79-U06c5mq9
```
### Client setup:
> [!IMPORTANT]
> It is recommended to use Sing-Box app due to more complete routing settings, but you can also import the link to [Hiddify](https://github.com/hiddify/hiddify-app/releases/latest) app or use any client app based on Sing-Box or Clash/Mihomo cores. If some apps are not proxied when using Hiddify, change the config options > service mode > VPN.
>
> On some devices, "stack": "system" in tun interface settings in client configs might not work. In such cases, it is recommended to replace it with "gvisor" by using option 4 in the settings menu (see above).
[Android, iOS and macOS](Sing-Box-Android-iOS-en.md). The guide is given for Android, the app interface is different on iOS and macOS, but it has similar settings.
[Windows](Sing-Box-Windows-en.md). This method includes setting up a pure Sing-Box core and does not have a GUI.
[Linux](#client-setup). Run the command below and follow the instructions (for Debian-based distributions).
```
bash <(curl -Ls https://raw.githubusercontent.com/A-Zuro/Secret-Sing-Box/master/Scripts/sb-pc-linux.sh)
```
### Stargazers over time:
[](https://starchart.cc/A-Zuro/Secret-Sing-Box)