Initial commit: VPS proxy server configs and security audit

2026-02-14 01:38:14 +08:00
commit 9ed13ff53a
7 changed files with 309 additions and 0 deletions
@@ -0,0 +1,64 @@
+# VPS Oracle Japan - Proxy Server
+
+## Server Info
+- IP: 158.101.140.85
+- OS: Ubuntu 24.04 LTS
+- SSH: `ssh server2`
+
+## VLESS + Reality (Xray)
+- Protocol: VLESS
+- Port: 443
+- UUID: 7bb711be-47a2-4273-aa8e-45bcb6216f70
+- Flow: xtls-rprx-vision
+- Security: reality
+- SNI: www.microsoft.com
+- Public Key: 203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms
+- Private Key: *(stored on server only — see `/usr/local/etc/xray/config.json`)*
+- Short ID: abcd1234
+- Fingerprint: safari
+
+### Client URI
+```
+vless://7bb711be-47a2-4273-aa8e-45bcb6216f70@158.101.140.85:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.microsoft.com&fp=safari&pbk=203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms&sid=abcd1234&type=tcp#Japan-VPS
+```
+
+## Tailscale
+- VPS: 100.70.115.1 (oracle-tokyo, exit node enabled)
+- NAS: 100.78.131.124 (ds224plus)
+- Phone: 100.83.55.44 (huawei-mate-70)
+- iPhone: 100.111.7.83 (iphone181)
+- Mac: 100.65.185.12 (macbook-air)
+
+## Files
+- `xray-config.json` — Xray server config (deployed to `/usr/local/etc/xray/config.json`)
+- `clash-meta.yaml` — Clash Meta client config for Android
+- `japan-vps-qr.png` — Shadowrocket QR code
+- `clash-meta-qr.png` — Clash Meta QR code
+
+## AdGuard Home
+- Web UI: http://100.70.115.1:3000 (Tailscale only)
+- DNS: 100.70.115.1:53
+- Login: admin / *(change default password!)*
+- Tailscale DNS: set 100.70.115.1 as nameserver at https://login.tailscale.com/admin/dns
+- **IMPORTANT**: In Tailscale admin DNS settings, enable "Use with exit node" for this nameserver
+  and "Override DNS servers" to bypass GFW DNS poisoning
+
+## Exit Node Setup Notes
+- UFW forward policy must be `ACCEPT` (in `/etc/default/ufw`)
+- NAT MASQUERADE rule for `ens3` added to `/etc/ufw/before.rules`
+- Without these, Tailscale exit node traffic is silently dropped
+
+## Services Running
+- Xray (VLESS+Reality) on port 443
+- Tailscale (exit node)
+- WireGuard on port 51820
+- AdGuard Home (DNS ad blocker)
+- fail2ban (SSH protection)
+
+## Security
+- SSH: key-only auth, root login disabled
+- UFW: only 22/tcp, 443/tcp (iptables), 51820/udp open
+- fail2ban: active
+- Old Clash Meta proxy: stopped and disabled
+- nginx: stopped and disabled
+- rpcbind: disabled