从零搭建 Caddy + Xray：VLESS REALITY + XHTTP + 特殊出口落地 + 订阅流量

1
{
2
  # 证书与 ACME 数据落盘，重启不重签
3
  storage file_system /home/tls
4
  email admin@example.com
5

6
  # DNS-01 挑战：证书签发只依赖 DNS，不占 80 端口
7
  acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
8

9
  log log0 {
10
    output file /var/log/caddy/access.log
11
    format json
12
  }
13

14
  # 关键：这个 HTTP 服务监听的是 Unix socket，不监听公网端口
15
  # listener_wrappers 先解开 PROXY protocol，再做 TLS 终止
16
  servers unix/@caddy-http.sock {
17
    name http-entry
18
    listener_wrappers {
19
      proxy_protocol
20
      tls
21
    }
22
    trusted_proxies cloudflare {
23
      interval 12h
24
      timeout 15s
25
    }
26
  }
27

28
  # layer4：接管 443 裸 TCP，转给 Xray REALITY，并附上 PROXY v2
29
  layer4 {
30
    tcp/:443 {
31
      route {
32
        proxy {
33
          upstream unix/@xray-reality.sock
34
          proxy_protocol v2
35
        }
36
      }
37
    }
38
  }
39
}
40

41
node.example.com {
42
  log log0
43

44
  # 站点绑定在 Unix socket 上（REALITY fallback 会连它）
45
  bind unix/@caddy-http.sock
46

47
  # 订阅服务
48
  handle /sub/* {
49
    reverse_proxy 127.0.0.1:8080
50
  }
51

52
  # 落地节点 A：注意放在通用 XHTTP 规则之前
53
  handle /xhttp-exit-a/* {
54
    reverse_proxy unix/@xray-exit-a.sock {
55
      transport http {
56
        versions 2
57
      }
58
      flush_interval -1
59
    }
60
  }
61

62
  # 落地节点 B
63
  handle /xhttp-exit-b/* {
64
    reverse_proxy unix/@xray-exit-b.sock {
65
      transport http {
66
        versions 2
67
      }
68
      flush_interval -1
69
    }
70
  }
71

72
  # 普通 XHTTP 节点（通用路径，放最后）
73
  handle /xhttp/* {
74
    reverse_proxy unix/@xray-xhttp.sock {
75
      transport http {
76
        versions 2
77
      }
78
      flush_interval -1
79
    }
80
  }
81

82
  # 兜底：静态站点
83
  handle {
84
    encode zstd gzip
85

86
    header {
87
      Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
88
      X-Content-Type-Options "nosniff"
89
      Referrer-Policy "strict-origin-when-cross-origin"
90
      X-Frame-Options "SAMEORIGIN"
91
    }
92

93
    @assets path /css/* /js/*
94
    @immutable path /uploads/* /images/* /fonts/*
95
    @documents not path /css/* /js/* /uploads/* /images/* /fonts/*
96

97
    header @documents Cache-Control "public, max-age=0, must-revalidate"
98
    header @assets Cache-Control "public, max-age=3600"
99
    header @immutable Cache-Control "public, max-age=2592000"
100

101
    root * /var/www/site
102
    file_server
103
  }
104

105
  handle_errors {
106
    @notfound expression {http.error.status_code} == 404
107
    rewrite @notfound /404.html
108
    root * /var/www/site
109
    file_server
110
  }
111
}

1
Environment=CLOUDFLARE_API_TOKEN=<CLOUDFLARE_API_TOKEN>

1
{
2
  "inbounds": [
3
    {
4
      "tag": "reality-main",
5
      "listen": "@xray-reality.sock",
6
      "protocol": "vless",
7
      "settings": {
8
        "clients": [],
9
        "decryption": "none",
10
        "fallbacks": [
11
          {
12
            "dest": "@caddy-http.sock"
13
          }
14
        ]
15
      },
16
      "streamSettings": {
17
        "network": "raw",
18
        "security": "reality",
19
        "realitySettings": {
20
          "show": false,
21
          "target": "@caddy-http.sock",
22
          "xver": 2,
23
          "serverNames": [
24
            "node.example.com"
25
          ],
26
          "publicKey": "<REALITY_PUBLIC_KEY>",
27
          "privateKey": "<REALITY_PRIVATE_KEY>",
28
          "shortIds": [
29
            "0123456789abcdef"
30
          ]
31
        },
32
        "sockopt": {
33
          "tcpFastOpen": true,
34
          "tcpcongestion": "bbr",
35
          "tcpMptcp": true,
36
          "tcpNoDelay": true
37
        },
38
        "rawSettings": {
39
          "acceptProxyProtocol": true
40
        }
41
      },
42
      "sniffing": {
43
        "enabled": true,
44
        "destOverride": [
45
          "http",
46
          "tls"
47
        ],
48
        "routeOnly": true
49
      }
50
    }
51
  ]
52
}

1
{
2
  "inbounds": [
3
    {
4
      "listen": "@xray-xhttp.sock",
5
      "protocol": "vless",
6
      "tag": "xhttp-main",
7
      "settings": {
8
        "clients": [],
9
        "decryption": "none"
10
      },
11
      "streamSettings": {
12
        "network": "xhttp",
13
        "xhttpSettings": {
14
          "host": "",
15
          "path": "/xhttp",
16
          "mode": "auto",
17
          "extra": {
18
            "noSSEHeader": true,
19
            "scMaxEachPostBytes": 1000000,
20
            "xPaddingBytes": "100-1000"
21
          }
22
        }
23
      },
24
      "sniffing": {
25
        "enabled": true,
26
        "destOverride": [
27
          "http",
28
          "tls",
29
          "quic"
30
        ]
31
      }
32
    }
33
  ]
34
}

1
{
2
  "inbounds": [
3
    {
4
      "listen": "@xray-exit-a.sock",
5
      "protocol": "vless",
6
      "tag": "xhttp-exit-a",
7
      "settings": { "clients": [], "decryption": "none" },
8
      "streamSettings": {
9
        "network": "xhttp",
10
        "xhttpSettings": {
11
          "host": "",
12
          "path": "/xhttp-exit-a",
13
          "mode": "auto",
14
          "extra": {
15
            "noSSEHeader": true,
16
            "scMaxEachPostBytes": 1000000,
17
            "xPaddingBytes": "100-1000"
18
          }
19
        }
20
      },
21
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"] }
22
    }
23
  ]
24
}

1
slug        exit-a
2
inbound tag xhttp-exit-a
3
path        /xhttp-exit-a
4
unix socket @xray-exit-a.sock
5
socks 出站  landing-exit-a

1
{
2
  "listen": "127.0.0.1:8080",
3
  "xray_api": "127.0.0.1:6765",
4
  "xray_bin": "/etc/goodnet/bin/xray",
5
  "xray_conf_dir": "/etc/goodnet/xray_conf",
6
  "db_path": "data/users.db",
7
  "admin_token": "<ADMIN_TOKEN>",
8
  "public_host": "node.example.com",
9
  "public_port": 443,
10
  "base_url": "https://node.example.com/sub",
11
  "inbounds": {
12
    "reality": "reality-main",
13
    "xhttp": "xhttp-main"
14
  },
15
  "reality": {
16
    "public_key": "<REALITY_PUBLIC_KEY>",
17
    "short_id": "0123456789abcdef",
18
    "fingerprint": "chrome",
19
    "server_names": ["node.example.com"]
20
  },
21
  "xhttp": {
22
    "path": "/xhttp",
23
    "mode": "auto"
24
  },
25
  "landing": {
26
    "users": ["alice"],
27
    "nodes": [
28
      { "name": "落地-A", "tag": "xhttp-exit-a", "path": "/xhttp-exit-a", "host": "node.example.com", "mode": "auto" },
29
      { "name": "落地-B", "tag": "xhttp-exit-b", "path": "/xhttp-exit-b", "host": "node.example.com", "mode": "auto" }
30
    ]
31
  },
32
  "keep_emails": ["debug"],
33
  "traffic_poll_seconds": 60
34
}

1
[Unit]
2
Description=Xray Service
3
After=network.target nss-lookup.target
4

5
[Service]
6
User=root
7
ExecStart=/etc/goodnet/bin/xray run -config /etc/goodnet/xray.json -confdir /etc/goodnet/xray_conf
8
Restart=on-failure
9
RestartPreventExitStatus=23
10
LimitNPROC=10000
11
LimitNOFILE=1000000
12
RuntimeDirectory=xray
13
RuntimeDirectoryMode=0755
14

15
[Install]
16
WantedBy=multi-user.target

1
[Unit]
2
Description=Goodnet Subscription Service
3
After=network.target xray.service
4
Wants=xray.service
5

6
[Service]
7
User=root
8
ExecStart=/etc/goodnet/bin/sub run -config /etc/goodnet/sub/config.json
9
Restart=on-failure
10
RestartSec=3
11
LimitNOFILE=1000000
12

13
[Install]
14
WantedBy=multi-user.target

1
地址:   node.example.com
2
端口:   443
3
UUID:   <用户 UUID>
4
流控:   xtls-rprx-vision
5
传输:   tcp
6
安全:   reality
7
SNI:    node.example.com
8
Fingerprint: chrome
9
PublicKey:   <REALITY_PUBLIC_KEY>
10
ShortId:     0123456789abcdef

1
地址:   node.example.com
2
端口:   443
3
UUID:   <用户 UUID>
4
传输:   xhttp
5
安全:   tls
6
SNI:    node.example.com
7
Host:   node.example.com
8
Path:   /xhttp
9
mode:   auto