reality-ezpz

Install and configure vless with reality or TLS on your linux server by executing a single command!

This script:

Installs docker with compose plugin in your server
Generates docker-compose.yml and sing-box/xray configuration for vless protocol for reality and tls
Create Cloudflare warp account and configure warp as outbound
Generates client configuration string and QRcode
Gets and renews valid certificate from Letsencrypt for TLS encryption
Fine-tunes kernel tunables
Is designed by taking security considerations into account to make the server undetectable

Features:

Generates client configuration string
Generates client configuration QRcode
You can choose between xray or sing-box core
You can choose between reality or TLS security protocol
You can use a Text-based user interface (TUI)
You can create multiple user accounts
You can regenerate configuration and keys
You can change SNI domain
You can change transport protocol (tcp, http, grpc, ws)
You can get valid TLS certificate with Letsencrypt
You can block malware and adult contents
Supports natvps.net servers
Use Cloudflare WARP to hide your outbound traffic
Supports Cloudflare warp+
Install with a single command

Supported OS:

Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
Debian 11
Debian 10
CentOS Stream 9
CentOS Stream 8
CentOS 7
Fedora 37

Quick Start

You can start using this script with default configuration by copy and paste the line below in terminal.

This command will configure sing-box with reality security protocol over tcp transport protocol on port 443 for www.google.com SNI domain by default:

bash <(curl -sL https://bit.ly/realityez)

or (if the above command dosen't work):

bash <(curl -sL https://raw.githubusercontent.com/aleskxyz/reality-ezpz/master/reality-ezpz.sh)

After a while you will get configuration string and QR code:

You can run TUI with -m or --menu option:

bash <(curl -sL https://bit.ly/realityez) -m

And then you will see management menu in your terminal:

Usage: reality-ezpz.sh [-t|--transport=tcp|http|grpc|ws] [-d|--domain=<domain>] [--server=<server>] [--regenerate] [--default]
  [-r|--restart] [-p|--path=<path>] [--enable-safenet=true|false] [--port=<port>] [--enable-natvps=true|false] [-c|--core=xray|sing-box]
  [--enable-warp=true|false] [--warp-license=<license>] [--security=reality|tls-valid|tls-invalid] [-m|--menu] [--show-server-config] 
  [--add-user=<username>] [--lists-users] [--show-user=<username>] [--delete-user=<username>] [-u|--uninstall]

  -t, --transport <tcp|http|grpc|ws> Transport protocol (http, grpc, tcp default: tcp)
  -d, --domain <domain>     Domain to use as SNI (default: www.google.com)
      --server <server>     IP address or domain name of server (Must be a valid domain if using ws)
      --regenerate          Regenerate public and private keys
      --default             Restore default configuration
  -r  --restart             Restart services
  -u, --uninstall           Uninstall reality
  -p, --path <path>         Absolute path to configuration directory (default: /root/reality)
      --enable-safenet <true|false> Enable or disable safenet (blocking malware and adult content)
      --port <port>         Server port (default: 443)
      --enable-natvps <true|false> Enable or disable natvps.net support
      --enable-warp <true|false> Enable or disable Cloudflare warp
      --warp-license <warp-license> Add Cloudflare warp+ license
  -c  --core <sing-box|xray> Select core (xray, sing-box, default: sing-box)
      --security <reality|tls-valid|tls-invalid> Select type of TLS encryption (reality, tls-valid, tls-invalid, default: reality)
  -m  --menu                Show menu
      --show-server-config  Print server configuration
      --add-user <username> Add new user
      --list-users          List all users
      --show-user <username> Shows the config and QR code of the user
      --delete-user <username> Delete the user
  -h, --help                Display this help message

Clients

Android
- v2rayNG
- NekoBox
iOS
Windows
- v2rayN

Security Options

This script can configure the service with 3 types of security options:

reality
tls-valid
tls-invalid

By default reality is configured but you can change the security protocol with --security option.

The tls-valid option will use Letsencrypt to get a valid certificate for you server. So you have to assign a valid domain or subdomain to your server with --server <domain> option.

The tls-invalid option is same as tls-valid but the certificates are self-signed and you don't need to assign a domain or subdomain to your server.

Compatibility and recommendation

CDN compatibility table:

	Cloudflare	ArvanCloud
reality	❌	❌
tls-invalid	✔️	✔️
tls-valid	✔️	✔️
tcp	❌	❌
http	❌	✔️
grpc	✔️	✔️
ws	✔️	✔️

You need to enable grpc or websocket in Cloudflare if you want to use the corresponding transport protocols.
You have to configure CDN provider to use HTTPS for connecting to your server.
The ws transport protocol is not compatible with reality security option.
Avoid using tcp transport protocol with tls-valid or tls-invalid security options.
Avoid using tls-invalid security option. Get a domain and use tls-valid option.
Do not change the port to something other than 443.
The sing-box core has better performance.
Using NekoBox for Android is recommended.

User Management

You can add, view and delete multiple user account with this script easily!

Add User

You can add additional user by using --add-user option:

bash <(curl -sL https://bit.ly/realityez) --add-user user1

This command will create test1 as a new user.

Notice: Username can only contains A-Z, a-z and 0-9

List Users

You can view a list of all users by using --list-users option:

bash <(curl -sL https://bit.ly/realityez) --list-users

Show User Configuration

You can get config string and QR code of the user for importing by using --show-user option:

bash <(curl -sL https://bit.ly/realityez) --show-user user1

This command will print config string and QR code of user1

Delete User

You can delete a user by using --delete-user option:

bash <(curl -sL https://bit.ly/realityez) --delete-user user1

This command will delete user1

Advanced Configuration

You can change script defaults by using different arguments.

Your configuration will be saved and restored in each execution. So You can run the script multiple time with out any problem.

Change SNI domain

Reality protocol will use the public certificate of SNI domain.

Default SNI domain is www.google.com.

You can change it by using --domain or -d options:

bash <(curl -sL https://bit.ly/realityez) -d yahoo.com

Change transport protocol

Default transport protocol is tcp.

You can change it by using --transport or -t options:

bash <(curl -sL https://bit.ly/realityez) -t http

Valid options are tcp,http, grpc and ws.

ws is not compatible with reality protocol. You have to use tls-valid or tls-invalid with it.

Block malware and adult contents

You can block malware and adult contents by using --enable-safenet option:

bash <(curl -sL https://bit.ly/realityez) --enable-safenet true

You can disable this feature with --enable-safenet false option.

Installing on natvps.net servers

By using --enable-natvps option you can use this script on natvps.net servers:

bash <(curl -sL https://bit.ly/realityez) --enable-natvps true

This script will find first available port automatically so you don't need to use --port option while using it.

You can disable feature with --enable-natvps false option.

It seems that natvps.net servers have some dns configuration problems and the curl package is not installed in them by default.

You can solve these problems by running this command:

grep -q "^DNS=1.1.1.1$" /etc/systemd/resolved.conf || echo "DNS=1.1.1.1" >> /etc/systemd/resolved.conf && systemctl restart systemd-resolved && apt update && apt install curl -y

Get runnig configuration

You can get the running configuration with --show-server-config option:

bash <(curl -sL https://bit.ly/realityez) --show-server-config

Regenerate configuration keys

You can regenerate keys by using --regenerate option:

bash <(curl -sL https://bit.ly/realityez) --regenerate

All other configuration will be same as before.

Restart services

You can restart the service by using -r or --restart options:

bash <(curl -sL https://bit.ly/realityez) -r

Restore default configuration

You can restore default configuration by using --default option.

bash <(curl -sL https://bit.ly/realityez) --default

User account will not change with this option.

Uninstall

You can delete configuration and services by using --uninstall or -u options:

bash <(curl -sL https://bit.ly/realityez) -u

Change configuration path

Default configuration path is $HOME/reality.

You can change it by using --path or -p options:

bash <(curl -sL https://bit.ly/realityez) -p /opt/reality

The path should be absolute path.

Change port

Notice: Do not change default port. This may block your IP!

Default port is 443.

In case of using tls-valid security option, port 80 has to be available for Letsencrypt challenge.

You can change it by using --port option:

bash <(curl -sL https://bit.ly/realityez) --port 8443

Change engine core

Default engine core is sing-box but you can also switch to xray by using --core or -c options:

bash <(curl -sL https://bit.ly/realityez) -c xray

Valid options are xray and sing-box.

Text-based user interface (TUI)

You can also use the TUI for changing the configuration of the service.

To access to TUI you can use -m or --menu options:

bash <(curl -sL https://bit.ly/realityez) -m

Cloudflare WARP

This script uses official Cloudflare WARP client for connecting to Cloudflare network and send all outbound traffic to Cloudflare server. So your servers address will be masked by Cloudflare IPs. This gives you a better web surffing experience due to less captcha challenges and also resolves some websites limitations on your servers IP.

You can enable Cloudflare WARP by using --enable-warp true option. This script will create and register a free WAPR account and use it.

bash <(curl -sL https://bit.ly/realityez) --enable-warp true

Free account has traffic limitation and lower performance in comparison with WARP+ account which needs license.

You can either buy an WARP+ Unlimited license or get a free WARP+ license from this telegram bot: https://t.me/generatewarpplusbot

After getting a license from that telegram bot, you can use the license for your server with --warp-license option:

bash <(curl -sL https://bit.ly/realityez) --warp-license aaaaaaaa-bbbbbbbb-cccccccc

You can use each warp+ license on 4 devices only.

You can disable Cloudflare WARP with --enable-warp false:

bash <(curl -sL https://bit.ly/realityez) --enable-warp false

Example

You can combine different options together.

We want to setup a server with these configurations:

grpc transport protocol
www.wikipedia.org as SNI domain
Block adult contents
Enable Cloudflare WARP
Set Cloudflare WARP+ license

So we need to execute this command:

bash <(curl -sL https://bit.ly/realityez) --transport grpc --domain www.wikipedia.com --enable-safenet true -enable-warp true --warp-license d34tgvde-gf73xvsj-23acfbg7

mahdisml / reality-ezpz