# VPS Oracle Japan - Proxy Server

## Server Info
- IP: 158.101.140.85
- OS: Ubuntu 24.04 LTS
- SSH: `ssh server2`

## VLESS + Reality (Xray)
- Protocol: VLESS
- Port: 443
- UUID: 7bb711be-47a2-4273-aa8e-45bcb6216f70
- Flow: xtls-rprx-vision
- Security: reality
- SNI: www.microsoft.com
- Public Key: 203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms
- Private Key: *(stored on server only — see `/usr/local/etc/xray/config.json`)*
- Short ID: abcd1234
- Fingerprint: safari

### Client URI
```
vless://7bb711be-47a2-4273-aa8e-45bcb6216f70@158.101.140.85:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.microsoft.com&fp=safari&pbk=203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms&sid=abcd1234&type=tcp#Japan-VPS
```

## Tailscale
- VPS: 100.70.115.1 (oracle-tokyo, exit node enabled)
- NAS: 100.78.131.124 (ds224plus)
- Phone: 100.83.55.44 (huawei-mate-70)
- iPhone: 100.111.7.83 (iphone181)
- Mac: 100.65.185.12 (macbook-air)

## Files
- `xray-config.json` — Xray server config (deployed to `/usr/local/etc/xray/config.json`)
- `clash-meta.yaml` — Clash Meta client config for Android
- `japan-vps-qr.png` — Shadowrocket QR code
- `clash-meta-qr.png` — Clash Meta QR code

## AdGuard Home
- Web UI: http://100.70.115.1:3000 (Tailscale only)
- DNS: 100.70.115.1:53
- Login: admin / *(change default password!)*
- Tailscale DNS: set 100.70.115.1 as nameserver at https://login.tailscale.com/admin/dns
- **IMPORTANT**: In Tailscale admin DNS settings, enable "Use with exit node" for this nameserver
  and "Override DNS servers" to bypass GFW DNS poisoning

## Exit Node Setup Notes
- UFW forward policy must be `ACCEPT` (in `/etc/default/ufw`)
- NAT MASQUERADE rule for `ens3` added to `/etc/ufw/before.rules`
- Without these, Tailscale exit node traffic is silently dropped

## Services Running
- Xray (VLESS+Reality) on port 443
- Tailscale (exit node)
- WireGuard on port 51820
- AdGuard Home (DNS ad blocker)
- fail2ban (SSH protection)

## Security
- SSH: key-only auth, root login disabled
- UFW: only 22/tcp, 443/tcp (iptables), 51820/udp open
- fail2ban: active
- Old Clash Meta proxy: stopped and disabled
- nginx: stopped and disabled
- rpcbind: disabled