transparent fallback xver proxy

[denni-hill]

I have a certain server with multiple domains on it, one of which I want to use for both serving traffic-intense website and reality xray proxy. My setup looks like:

Nginx(L4) SNI routing to either xray or caddy (here I have my vhosts with auto acme)
Then xray configured to fallback to caddy if reality checks failed.

nginx config

{
      events {
          worker_connections  1024;
      }

      stream {
        map $ssl_preread_server_name $backend {
          $DOMAIN                       xray;
          default                       www;
        }

        upstream xray {
          server xray:443;
        }

        upstream www {
          server caddy:443;
        }

        server {
          listen          443;
          proxy_pass      $backend;
          proxy_protocol  on;
          ssl_preread     on;
        }
      }
}

xray inbound

{
            "port": 443,
            "protocol": "vless",
            "tag": "vless_tls",
            "settings": {
              "clients": [
                {
                  "id": "xxx",
                  "email": "xxx@xxx",
                  "flow": "xtls-rprx-vision"
                }
              ],
              "decryption": "none",
              "fallbacks": [
                {
                  "dest": "caddy:443"
                  "xver": 1
                }
              ]
            },
            "streamSettings": {
              "network": "raw",
              "security": "reality",
              "realitySettings": {
                "show": false,
                "target": "caddy:443",
                "xver": 0,
                "serverNames": [
                  "$DOMAIN"
                ],
                "privateKey": "xxx",
                "minClientVer": "",
                "maxClientVer": "",
                "maxTimeDiff": 0,
                "shortIds": [
                  "xxx"
                ]
              },
              "sockopt": {
                "acceptProxyProtocol": true
              }
            },
            "sniffing": {
              "enabled": false
            }
          }

Caddy also configured to receive proxy protocol

Now the bummer: this setup works just fine except for xray does not transparently pass proxy information it obtained from upstream proxy to downstream web server resulting in misbehavior of certain features this website implements, like fail2ban. Would it be possible to add an option to make proxy transparent somehow?