How to Setup Xray + VLESS + Reality + Caddy?

[Gill-Bates]

Friends, I'm going mad with the configuration. I need your support.

I want to set up a simple VPN that terminates TLS at Caddy's reverse proxy:

I have achieved the following:

When I set it up with websocket, everything works as it should, but I get the following message:

2025/03/24 13:05:27.780639 [Warning] common/errors: This feature WebSocket transport (with ALPN http/1.1, etc.) is deprecated and being migrated to XHTTP H2 & H3. Please update your config(s) according to release note and documentation before removal.

    "inbounds": [
        {
            "port": 10000,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "00000000",
                        "email": "[email protected]"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "ws",
                "wsSettings": {
                    "path": "/api/v1"
                },
                "security": "none"
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            },
            "mux": {
                "enabled": true,
                "concurrency": 8
            }
        }
    ]

If I set to VLESS + XHTTP, it only works if the client terminates directly on port 443 on Xray. As soon as I switch Caddy in front of it, I get error messages like SSL Library Error oder Remote Peer closed Connection.

Can anyone help me with the configuration?

[i-eat-helicopter]

You cannot get caddy to tunnel REALITY TLS connections. Figuratively speaking, REALITY uses a kind of secret knocking with TLS handshakes that Caddy obviously doesn't recognize.
You need to put caddy behind REALITY's fallback

[wangdaye078]

caddy config:

........
	@xhttp {
		path /releases_xhttp/*
	}
	reverse_proxy @xhttp 127.0.0.1:445 {
		transport http {
			versions h2c 2
		}
	}
.........

xray server config:

........
    {
      "port": 445,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "xxxxxxxxxxxxxxxxxxxxxx",
            "alterId": 0,
            "level": 0
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
           "path": "/releases_xhttp"
        },
        "security": "none"
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
	  "quic"
        ]
      }
    },

........

[Gill-Bates]

Did you try that? I miss the SNI-Settings for the Fake Handshake

You terminate TLS on Caddy and sending unencrypted Traffic to Reality on Layer 7. I've been trying this without success, because Reality expects Layer 4, sfaik

[wangdaye078]

This is a part of the configuration I am currently using

[Gill-Bates]

Wait - you are using VLESS + XHTTP! I was looking for VLESS + REALITY + XTLS.
In your Case, I would prefer Trojan over XHTTP

[i-eat-helicopter]

That doesn't make sense. xhttp is a transport method, torjan and vless etc. are proxy protocols. They are on different layers. You use proxy protocols on top of the transport method.

[xkdvSrPD]

Maybe you can find the answer here

https://github.com/lxhao61/integrated-examples