Self-host Xray VPN OneClick
v2.0.1One-click VLESS+Reality VPN server deployment for Linux
- Stars
- 349
- CPU
- 1 core
- RAM
- 512 MB
- Storage
- 100 MB
- Port
- 443 (VLESS+Reality proxy server (masquerades as TLS 1.3))
- Requires
- Node.js, Systemd, Xray-core
What is Xray VPN OneClick?
Xray VPN OneClick automates deployment of an Xray proxy server using the VLESS + XTLS-Reality protocol on a Linux VPS. A single command installs Xray-core, generates keys and UUIDs, configures systemd, and enables BBR. The companion npm CLI (xray-manager) provides a terminal UI for managing users, enforcing bandwidth quotas with auto-disable, generating subscription links for V2Ray and Clash clients, sending Telegram alerts, and exposing a REST API with Bearer token auth. Supported distributions include recent Ubuntu, Debian, CentOS, Fedora, and Amazon Linux releases. Minimum specs are 512 MB RAM and 100 MB disk. The server listens on port 443 by default, masquerading as normal TLS 1.3 traffic. Licensed under MIT with a legal NOTICE restricting use to lawful purposes.
Should you self-host Xray VPN OneClick?
Xray VPN OneClick scores 50/100 on selfhost.directory (how scoring works) and ranks #35 of 56 in VPN. It has 349 GitHub stars.
It shipped 9 stable releases in the past year. The latest, v2.0.1, came out on 21 April 2026. New versions land roughly every 1 days.
Setup is moderate: expect some configuration beyond a single command. It is MIT-licensed and written mostly in Typescript.
Its closest alternative on selfhost.directory is Tailscale (84/100, 38 203 stars). It scores higher overall, so compare the two before you pick. See Xray VPN OneClick vs Tailscale side by side.
Features
- BBR + TCP Fast Open
- Clash config generation
- Configuration backup/restore
- Interactive terminal UI
- Log viewer
- Multi-platform client support
- Real-time monitoring
- REST API
- Scheduled Tasks
- Subscription links
- Telegram Notifications
- Traffic quota management
- User Management
- VLESS + Reality protocol
Xray VPN OneClick README
FAQ
How can I improve connection speed?
Enable BBR congestion control and TCP Fast Open by adding the appropriate sysctl settings and running sysctl -p.
How do I change the Reality masquerade destination website?
Edit /usr/local/etc/xray/config.json and change the 'dest' and 'serverNames' fields to a different site like www.microsoft.com or www.apple.com.
Why can't my client connect to the server?
Verify the Xray service is running, check firewall rules (ufw), confirm cloud provider security group allows port 443, validate config values (UUID, public key), and check service logs.
What if port 443 is already in use?
Check which process is using port 443 with 'sudo lsof -i :443', stop that service (e.g., nginx), or modify Xray config to use a different port.
More in Network Security
Zed Attack Proxy (ZAP)Self-hosted, open-source web app security scanner: an intercepting proxy with passive and active scans, three spiders, API scans and Docker automation for CI/CD.
3proxySelf-hosted, open-source tiny proxy server: HTTP/HTTPS, SOCKS4/5, FTP, DNS and port mapping with ACLs, bandwidth limits and parent chaining.
amneziawg-installerSelf-hosted, open-source AmneziaWG 3.1 VPN server you provision on your own VPS with a single bash script: DPI-proof obfuscation, no Docker, kernel module.
beelzebubOpen-source, self-hosted deception runtime that turns SSH, HTTP, TCP, Telnet, MCP decoys into honeypots, configured via YAML rules, with LLM replies and Go plugins.
bettercapOpen-source, self-hosted Go framework for network reconnaissance and MITM attacks on WiFi, BLE, HID, CAN-bus and IPv4/IPv6 networks, with a built-in web UI and REST API.
CacheGuard-OSSelf-hosted open-source UTM appliance OS turning x86/x64 machines into complete network security gateways with firewall, VPN, WAF, antivirus, and more.
cactusdcactusd is an open-source, self-hosted daemon that aggregates and serves domain/IP blocklists for DNS-based ad-blocking, updating every 12 hours with a built-in web UI.
circuitbreakerSelf-hosted, open-source firewall for Lightning nodes that limits in-flight HTLCs and applies per-peer rate limits to protect channel liquidity.
cloudflare-allowmeSelf-hosted open-source service that dynamically manages Cloudflare firewall IP allowlists via REST API for securing self-hosted apps.
CrowdSec Blocklist MirrorSelf-hosted, open-source HTTP blocklist mirror exposing CrowdSec decisions in multiple formats for network appliances.
defguardSelf-hosted WireGuard VPN platform bundling an identity provider, per-connection MFA, LDAP/AD sync and firewall ACLs; open-source AGPL core written in Rust.
dnscrypt-proxySelf-hosted, open-source DNS proxy for your machine or router: encrypts queries with DNSCrypt, DoH and ODoH, filters ads/malware, caches and balances resolvers.
0 comments