Protocols

Every Xray inbound binds to 127.0.0.1. Nginx owns the real, Cloudflare-compatible public ports and proxies inward, which is what makes CDN fronting and shared certificates possible.

10001 vmess-ws      10011 vmess-xhttp      10021 vmess-httpupgrade
10002 vless-ws      10012 vless-xhttp      10022 vless-httpupgrade
10003 trojan-ws     10013 trojan-xhttp     10023 trojan-httpupgrade
10085 api-in (stats / gRPC handler API)

base offsets: ws=10000, xhttp=10010, httpupgrade=10020, tcp=10030, grpc=10040
protocol index: vmess=1, vless=2, trojan=3

{
  "tcpNoDelay": true,
  "tcpFastOpen": true,
  "tcpcongestion": "bbr",
  "tcpKeepAliveIdle": 30,
  "tcpKeepAliveInterval": 15
}

SSH accounts are real Linux users, created by the provisioning script with a hardened sshd drop-in. Understanding this removes most SSH support tickets.

• Expiry padding. Linux account expiry is date-granular and disables at start-of-day, so the script sets the expiry to the day after EXPIRES. Exact-hour and quota enforcement is done separately by the agent.
• Login shell wrapper. /usr/local/bin/grvpn-motd prints the banner (fetched from the local agent, or /etc/grvpn-ssh-banner.html), strips HTML, then execs a real shell. Many tunnel clients (HTTP Custom, Injector, HA Tunnel, NetMod) need an interactive PTY behind sshd or they see immediate EOF.
• Hardening in sshd_config.d/99-grvpn.conf: password and keyboard-interactive auth on, PermitOpen restricted to the Cloudflare-supported port list so local forwards cannot pivot to arbitrary internal hosts, PermitListen none (remote -R forwards fully disabled), GatewayPorts no, X11Forwarding no.
• Drop-in repair. Earlier over-restrictive drop-ins (AllowTcpForwarding no, DisableForwarding yes) are stripped, the managed user is appended to any existing AllowUsers (OpenSSH is first-match) and removed from DenyUsers.
• Password handling. The script hashes with openssl passwd -6 (or Python crypt) and applies it via usermod -p, bypassing PAM cracklib rejecting short or username-like passwords.
• Unlock logic. configure_login_user() creates or updates the user, sets shell, expiry and hash, force-unlocks (usermod -U / passwd -u) and removes /etc/nologin — the usual cause of “account exists but is locked from a previous revoke”.

1. 1
   Ensure Xray is installed — setup_xray.sh runs if the binary or /usr/local/etc/xray/config.json is missing.
2. 2
   Add the client to the correct inbound via xray_client.py add <proto>.
3. 3
   Validate with xray run -test before restarting the service. A failed config test is exactly what produces an account stuck in pending.
4. 4
   Restart Xray, or for suspensions use the gRPC handler API (xray api rmu -tag=<inbound> <email>) to kick a single user instantly without dropping everyone else’s sessions.

• ZIVPN has no per-user config: /etc/zivpn/config.json holds auth.config, the array of all valid passwords. With no accounts it becomes ["disabled"], which locks out every client.
• The OBFS password is fleet-wide and identical on every node, so one client profile works everywhere. The service restarts only when the value actually changes.
• Egress is plane-wide: the outbound chosen for the zivpn protocol key becomes the whole node’s ZIVPN upstream (WARP → local SOCKS5, address+port → that SOCKS5, otherwise direct).
• Installing the tunnel is a prerequisite — account creation returns 400 until Tunnels → ZIVPN UDP is installed on the target host.

Each account with a non-zero speed cap gets its own cloned outbound tagged mk-<mark> with a unique sockopt.mark, plus a routing rule sending that user through it. tc then shapes by socket mark instead of client IP — which is what makes caps work behind CDNs, on IPv6 and before the first packet is seen.

• Speed caps work for WARP-routed users too: the mark travels through the WireGuard outbound's own socket.
• Blocking rules are inserted ahead of speed-mark routes, so blocking always wins.