IP 被墙 VPS 自救:VLESS+WS+TLS+Cloudflare 全链路手册

openssl x509 -in certs/<DOMAIN>/fullchain.pem -noout -modulus | md5
openssl rsa  -in certs/<DOMAIN>/privkey.pem  -noout -modulus | md5

mkdir -p /opt/nginx-proxy-manager && cd /opt/nginx-proxy-manager
cat > docker-compose.yml <<'EOF'
services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
EOF
docker compose up -d

DB=/opt/nginx-proxy-manager/data/database.sqlite
NPW=$(openssl rand -base64 18)
HASH=$(docker exec -e PW="$NPW" nginx-proxy-manager node -e 'console.log(require("bcrypt").hashSync(process.env.PW,10))')
NOW=$(date '+%Y-%m-%d %H:%M:%S')
sqlite3 $DB "insert into user (created_on,modified_on,is_deleted,is_disabled,email,name,nickname,avatar,roles) values ('$NOW','$NOW',0,0,'admin@<DOMAIN>','admin','admin','','[\"admin\"]');"
NEWUID=$(sqlite3 $DB "select max(id) from user;")   # 注意:别用 UID,bash 的 UID 是只读变量
sqlite3 $DB "insert into auth (created_on,modified_on,user_id,type,secret,meta,is_deleted) values ('$NOW','$NOW',$NEWUID,'password','$HASH','{}',0);"
sqlite3 $DB "insert into user_permission (created_on,modified_on,user_id,visibility,proxy_hosts,redirection_hosts,dead_hosts,streams,access_lists,certificates) values ('$NOW','$NOW',$NEWUID,'all','manage','manage','manage','manage','manage','manage');"
umask 077; printf 'NPM admin (http://127.0.0.1:81)\nemail: admin@<DOMAIN>\npassword: %s\n' "$NPW" > /root/npm-creds.txt
# 验证登录(只输出 OK/FAIL,不回显 token)
curl -s -X POST http://127.0.0.1:81/api/tokens -H "Content-Type: application/json" \
  -d "{\"identity\":\"admin@<DOMAIN>\","'"secret":"'"$NPW\"}" | jq -r 'if .token then "OK" else "FAIL" end'

XRAY=/usr/local/x-ui/bin/$(ls /usr/local/x-ui/bin/ | grep -i '^xray' | head -1)
UUID=$($XRAY uuid); EMAIL=$(openssl rand -hex 5); WSPATH=/ws-$(openssl rand -hex 6); SUBID=$(openssl rand -hex 8)
umask 077; printf 'UUID=%s\nWSPATH=%s\nSUBID=%s\n' "$UUID" "$WSPATH" "$SUBID" > /root/ws-setup.env

sqlite3 /etc/x-ui/x-ui.db ".backup /root/x-ui.db.bak-$(date +%F-%H%M%S)"
systemctl stop x-ui
UUID="$UUID" WSPATH="$WSPATH" EMAIL="$EMAIL" SUBID="$SUBID" python3 - <<'PY'
import sqlite3, json, os, time
U, WS, EM, SUB = os.environ['UUID'], os.environ['WSPATH'], os.environ['EMAIL'], os.environ['SUBID']
now = int(time.time()*1000)
db = sqlite3.connect('/etc/x-ui/x-ui.db'); cur = db.cursor()
if cur.execute("SELECT id FROM inbounds WHERE port=<WSPORT>").fetchone(): raise SystemExit("port exists")
settings = json.dumps({"clients":[{"id":U,"email":EM,"flow":"","enable":True,"expiryTime":0,"limitIp":0,"totalGB":0,"reset":0,"subId":SUB,"tgId":0,"security":"auto","comment":""}],"decryption":"none","fallbacks":[],"insecure":False})
stream = json.dumps({"network":"ws","security":"none","wsSettings":{"path":WS,"host":"<DOMAIN>","headers":{"Host":"<DOMAIN>"}},"externalProxy":[{"dest":"<DOMAIN>","port":443,"forceTls":"tls","sni":"<DOMAIN>","hostHeader":"<DOMAIN>","remark":"cf-cdn"}]})
sniff = json.dumps({"enabled":True,"destOverride":["http","tls","quic"]})   # 不要配 fingerprint
cur.execute("INSERT INTO inbounds (user_id,up,down,total,remark,enable,listen,port,protocol,settings,stream_settings,tag,sniffing,node_id,share_addr_strategy,share_addr,disable_flow) VALUES (1,0,0,0,'vless-ws-cf',1,'',<WSPORT>,'vless',?,?,?,'inbound-<WSPORT>-ws',NULL,'node','',0)", (settings,stream,sniff))
iid = cur.lastrowid
cur.execute("INSERT INTO clients (email,sub_id,uuid,security,enable,created_at,updated_at) VALUES (?,?,?,'auto',1,?,?)", (EM,SUB,U,now,now))
cid = cur.lastrowid
cur.execute("INSERT INTO client_inbounds (client_id,inbound_id,flow_override,created_at) VALUES (?,?,'',?)", (cid,iid,now))
cur.execute("INSERT INTO client_traffics (inbound_id,enable,email,up,down,expiry_time,total) VALUES (?,1,?,0,0,0,0)", (iid,EM))
db.commit(); print("inbound=%d client=%d" % (iid,cid))
PY
systemctl start x-ui; sleep 8
ss -tlnp | grep ":<WSPORT> "          # 应看到 xray 主进程在监听
jq -c '[.inbounds[]|select(.port==<WSPORT>)|{tag,clients:(.settings.clients|length)}]' /usr/local/x-ui/bin/config.json

TOK=$(curl -s -X POST http://127.0.0.1:81/api/tokens -H "Content-Type: application/json" -d "{\"identity\":\"admin@<DOMAIN>\",\"secret\":\"$(grep ^password /root/npm-creds.txt | cut -d' ' -f2)\"}" | jq -r .token)
CID=$(curl -s -X POST http://127.0.0.1:81/api/nginx/certificates -H "Authorization: Bearer $TOK" -H "Content-Type: application/json" -d '{"provider":"other","nice_name":"<DOMAIN>-cf-origin"}' | jq -r .id)
curl -s -X POST http://127.0.0.1:81/api/nginx/certificates/$CID/upload -H "Authorization: Bearer $TOK" \
  -F certificate=@certs/<DOMAIN>/fullchain.pem -F certificate_key=@certs/<DOMAIN>/privkey.pem

mkhost(){ curl -s -X POST http://127.0.0.1:81/api/nginx/proxy-hosts -H "Authorization: Bearer $TOK" -H "Content-Type: application/json" -d "$1" | jq -r 'if .id then "OK "+(.domain_names|join(",")) else (.error.message) end'; }
# 1) 裸域 → xray ws(websocket 升级头靠 host 级 allow_websocket_upgrade)
mkhost "$(jq -nc --argjson cid $CID '{domain_names:["<DOMAIN>"],forward_scheme:"http",forward_host:"172.17.0.1",forward_port:<WSPORT>,certificate_id:$cid,ssl_forced:true,http2_support:true,hsts_enabled:false,caching_enabled:false,block_exploits:true,allow_websocket_upgrade:true,meta:{}}')"
# 2) nginx.<DOMAIN> → NPM 自身管理界面
mkhost "$(jq -nc --argjson cid $CID '{domain_names:["nginx.<DOMAIN>"],forward_scheme:"http",forward_host:"127.0.0.1",forward_port:81,certificate_id:$cid,ssl_forced:true,http2_support:true,hsts_enabled:false,caching_enabled:false,allow_websocket_upgrade:true,meta:{}}')"
# 3) xui.<DOMAIN> → 3x-ui 面板
mkhost "$(jq -nc --argjson cid $CID '{domain_names:["xui.<DOMAIN>"],forward_scheme:"http",forward_host:"172.17.0.1",forward_port:<PPORT>,certificate_id:$cid,ssl_forced:true,http2_support:true,hsts_enabled:false,caching_enabled:false,allow_websocket_upgrade:true,meta:{}}')"

ufw allow 80/tcp comment 'NPM http'; ufw allow 443/tcp comment 'NPM https'
ufw allow from 172.16.0.0/12 to any port <WSPORT> proto tcp comment 'docker bridges to x-ui xray ws'
ufw allow from 172.16.0.0/12 to any port <PPORT> proto tcp comment 'docker bridges to x-ui panel'

vless://<UUID>@<DOMAIN>:443?encryption=none&security=tls&sni=<DOMAIN>&type=ws&host=<DOMAIN>&path=<WSPATH>#<DOMAIN>-ws-cf

curl -s -o /dev/null -w "%{http_code}\n" https://<DOMAIN>/            # 400/404(xray 应答,预期)
curl -s -o /dev/null -w "%{http_code}\n" https://nginx.<DOMAIN>/      # 200
# ws 握手探测:带升级头打真实 path,返 400 = 链路通(xray 拒假握手属预期)
curl -s --resolve <DOMAIN>:443:127.0.0.1 -H "Connection: Upgrade" -H "Upgrade: websocket" \
     -o /dev/null -w "%{http_code}\n" https://<DOMAIN><WSPATH>

curl --socks5-hostname 127.0.0.1:10888 -o /dev/null -w "%{http_code}\n" https://www.google.com
curl --socks5-hostname 127.0.0.1:10888 https://ifconfig.me