sbx-lite

One-click sing-box proxy deployment with Reality-first defaults and optional multi-protocol support.

Quick Start

bash <(curl -fsSL https://raw.githubusercontent.com/xrf9268-hue/sbx/main/install.sh)

Done! Connection URIs are displayed after installation. Copy them to your client.

With domain (defaults to Reality + WS-TLS + Hysteria2):

DOMAIN=your.domain.com bash <(curl -fsSL https://raw.githubusercontent.com/xrf9268-hue/sbx/main/install.sh)

Enable TUIC / Trojan too:

DOMAIN=your.domain.com ENABLE_TUIC=1 ENABLE_TROJAN=1 bash <(curl -fsSL https://raw.githubusercontent.com/xrf9268-hue/sbx/main/install.sh)

Cloudflare proxy mode (when server IP is blocked):

DOMAIN=your.domain.com CF_MODE=1 bash <(curl -fsSL https://raw.githubusercontent.com/xrf9268-hue/sbx/main/install.sh)

DNS-01 challenge (when port 80 is blocked):

CF_API_TOKEN=your_token CERT_MODE=cf_dns DOMAIN=your.domain.com bash <(curl -fsSL https://raw.githubusercontent.com/xrf9268-hue/sbx/main/install.sh)

Note: See docs/ADVANCED.md for how to create a Cloudflare API token.

Features

• Zero config - Auto-detects IP, no domain/certs needed for Reality-only installs
• Domain-mode defaults - VLESS-REALITY, VLESS-WS-TLS, Hysteria2
• Optional extra protocols - TUIC V5 and Trojan via ENABLE_TUIC=1 / ENABLE_TROJAN=1
• Cloudflare support - CF_MODE for CDN proxying when IP is blocked
• DNS-01 challenge - Certificate issuance without port 80 via Cloudflare API
• Easy export - QR codes, v2rayN/Clash configs, share URIs
• Traffic statistics - sbx stats live throughput, connections and per-user breakdown via Clash API (see docs/STATS.md)

Usage

sbx info      # Show connection URIs
sbx qr        # QR codes for mobile
sbx status    # Service status
sbx check     # Validate config
sbx health    # Comprehensive health report
sbx stats     # Traffic and connection overview
sbx export    # Export URIs / client configs / QR codes
sbx tunnel    # Cloudflare Tunnel management
sbx help      # All commands

Client Setup

Platform	Recommended Client
Windows	v2rayN (sing-box core)
macOS	Hiddify
Linux	Hiddify
Android	sing-box (official SFA)
iOS	sing-box (official SFI)

Import: Copy URI → Paste in client → Connect

v2rayN users: Switch core to sing-box in Settings → Core Type

Troubleshooting

sbx status    # Is service running?
sbx check     # Config valid?
sbx health    # Full runtime health checks
sbx log       # Error messages?

Common fix: v2rayN "connection failed" → Switch core from Xray to sing-box

See REALITY_TROUBLESHOOTING.md for more solutions.

Requirements

• Linux (Debian, Ubuntu, CentOS, Fedora, RHEL)
• Root access
• Ports available (default domain mode):
  • 443/tcp - VLESS-Reality
  • 80/tcp - ACME HTTP-01 challenge (certificate issuance, with domain)
  • 8444/tcp - VLESS-WS-TLS (with domain)
  • 8443/udp - Hysteria2 (with domain)
  • 8445/udp - TUIC V5 (optional, with ENABLE_TUIC=1)
  • 8446/tcp - Trojan (optional, with ENABLE_TROJAN=1)
• Ports available (Reality-only / IP mode):
  • 443/tcp - VLESS-Reality only
• Ports available (CF_MODE=1):
  • 443/tcp - VLESS-WS-TLS through Cloudflare CDN
  • Optional direct fallback: REALITY_PORT if ENABLE_REALITY=1
• Ports available (CERT_MODE=cf_dns):
  • Same protocol ports as domain mode, but 80/tcp is not required

Documentation

Doc	Description
Troubleshooting	Connection & installation issues
Best Practices	Security & performance tips
Advanced Options	Environment variables & customization
Cloudflare Tunnel	Expose WS-TLS through Cloudflare Tunnel with sbx tunnel
Telegram Bot	Remote management via Telegram commands
Traffic Statistics	sbx stats CLI, Clash API secret rotation, yacd/metacubexd setup
Architecture Diagrams	Module structure & installation flowcharts
Contributing	Developer setup & guidelines

License

MIT License - Based on sing-box by SagerNet