easyxray：简单、安全的 Xray 服务器管理工具 / A simple and safe Xray server manager

[driftray]

easyxray：简单、安全的 Xray 服务器管理工具 / A simple and safe Xray server manager

https://github.com/driftray/easyxray

大家好，分享一个我写的 Xray-core 服务器管理脚本，希望对需要自建节点的朋友有用。

Hi everyone, I'd like to share an Xray-core server management script I wrote. I hope it's useful for anyone running their own server.

它做什么 / What it does

一条命令完成证书申请、Xray 安装、伪装站点、防火墙和 BBR，之后用中文菜单或命令行管理用户、协议、订阅和 WARP 分流。

One command sets up the certificate, Xray, a camouflage site, the firewall and BBR. After that, users, protocols, subscriptions and WARP routing are managed through a Chinese menu or the command line.

特点 / Highlights

• 修改前自动校验，失败自动回滚：所有配置由一个状态文件统一生成，每次修改先经过 xray run -test 和 nginx -t，新配置启动失败时自动恢复上一份。
  Validated changes with automatic rollback: all configs are generated from a single state file. Every change is checked with xray run -test and nginx -t, and the previous config is restored if the new one fails to start.

• 不运行第三方脚本或二进制：证书使用系统源里的 certbot，Xray 从官方 Release 下载并校验 SHA256，WARP 直接调用 Cloudflare 的注册接口。
  No third-party scripts or binaries: certificates come from the distro's certbot, Xray is downloaded from the official release and verified against its SHA256 digest, and WARP is registered directly through Cloudflare's API.

• Xray 不以 root 运行：使用专用用户，只授予绑定低端口和创建 WARP 网卡两项权限。
  Xray does not run as root: it uses a dedicated user with only two capabilities, binding low ports and creating the WARP interface.

• 少暴露端口、独立密钥：推荐安装只开启两个协议；Reality 密钥、shortId、路径和混淆密码都在安装时随机生成。
  Fewer exposed ports, unique keys: the recommended install enables only two protocols, and Reality keys, shortIds, paths and obfuscation passwords are generated per server.

支持的协议 / Protocols

• VLESS + Reality + Vision（TCP 443）
• Hysteria2 + Salamander
• VLESS + XHTTP + TLS
• VLESS + Reality + XHTTP
• VLESS + TLS + Vision

推荐安装 Reality-Vision 和 Hysteria2，也可以一次安装全部 5 个。Reality 的回落目标是本机 Nginx 上的自有域名站点。

The recommended install sets up Reality-Vision and Hysteria2; you can also install all five. Reality falls back to a site on the local Nginx that uses your own domain.

安装 / Install

需要 Debian 12+ 或 Ubuntu 22.04+，以及一个解析到服务器的域名。
Requires Debian 12+ or Ubuntu 22.04+ and a domain pointing to the server.

git clone https://github.com/driftray/easyxray.git /opt/easyxray
/opt/easyxray/easyxray install --domain your.domain.com

说明 / Notes

目前是 v0.1.0，已在 Ubuntu 24.04 上完整测试过。欢迎提 Issue 反馈问题和建议。

This is v0.1.0 and has been fully tested on Ubuntu 24.04. Issues and suggestions are welcome.

项目采用 GPL-3.0 许可证。感谢 Xray-core 团队的工作。
Licensed under GPL-3.0. Thanks to the Xray-core team for their work.

[driftray]

easyxray 更新：v0.1.0 → v0.4.2 / Update: v0.1.0 → v0.4.2

https://github.com/driftray/easyxray

一条命令安装 / One-command install

现在用一个入口脚本安装和管理：先检查系统、端口和网络，再从 Release 下载程序包并校验 SHA256。已经安装过的机器，再运行同一条命令会直接进入管理菜单。

A single entry script now handles both install and management. It checks the system, ports and network first, then downloads the release package and verifies its SHA256. On a machine that already has it installed, the same command opens the management menu.

wget -N https://raw.githubusercontent.com/driftray/easyxray/main/install.sh && bash install.sh

新功能 / What's new

• 防探测：XHTTP-TLS 改为由 Nginx 处理 TLS，TLS-Vision 增加 h2 回落。没有凭据的探测只能看到普通网站。
  Anti-probing: TLS for XHTTP-TLS is now handled by Nginx, and TLS-Vision gets an h2 fallback. Probes without valid credentials only see an ordinary website.
• 备份与迁移：ezx backup 导出备份，在新服务器上恢复后，客户端不用重新导入。
  Backup and migration: ezx backup exports a backup. After restoring it on a new server, clients don't need to re-import anything.
• geo 数据更新：来源与 Xray 官方发布包相同（XTLS/Xray-rules-dat），校验并确认当前规则可用后才��换，默认每周自动更新。
  geo data updates: from the same source as the official Xray release (XTLS/Xray-rules-dat). Files are replaced only after they are verified and the current rules still work. Updates run weekly by default.
• Xray 版本管理：可以切换到推荐版本（经过测试，当前为 v26.10.29）、最新正式版或指定版本。新版本无法使用时自动换回原来的版本。
  Xray version management: switch to the recommended version (tested, currently v26.10.29), the latest stable release, or a specific version. If the new version fails, the previous one is restored automatically.
• 其他：ezx rekey 重新生成密钥，默认屏蔽 BT，ezx update 自更新，卸载可以选择保留配置。
  Also: ezx rekey regenerates keys, BT is blocked by default, ezx update updates easyxray itself, and uninstall can keep the config.

测试与客户端 / Testing and clients

已在 Ubuntu 24.04 和 26.04 上完整测试。推荐客户端为 Shadowrocket 和 v2rayN。由于 Xray 26.9.8 起 Reality 要求 X25519MLKEM768，Clash（mihomo）和 sing-box 内核的客户端暂时连不上 Reality 节点，可以改用 Hysteria2、XHTTP-TLS 或 VLESS-TLS-Vision。

Fully tested on Ubuntu 24.04 and 26.04. Recommended clients are Shadowrocket and v2rayN. Since Xray 26.9.8, Reality requires X25519MLKEM768, so clients built on Clash (mihomo) or sing-box can't connect to Reality nodes for now. Use Hysteria2, XHTTP-TLS or VLESS-TLS-Vision instead.

欢迎提 Issue 反馈。 / Issues and feedback are welcome.