JQ's Proxy Stack Manager

August 28, 2026 · View on GitHub

JQ's Proxy Stack Manager

All-in-one Linux proxy server manager · Xray / sing-box / mihomo triple cores

       _    ___          ____    ____    __  __
      | |  / _ \        |  _ \  / ___| |  \/  |
   _  | | | | | |       | |_) | \___ \ | |\/| |
  | |_| | | |_| |       |  __/   ___) | | |  | |
   \___/   \__\_|       |_|     |____/ |_|  |_|

  Proxy Stack Manager  ·····  ◆ jinqians.com
  ──────────────────────────────────────────
  IP    ▶  x.x.x.x              Nginx     ▶  1.x.x
  Xray  ▶  x.x.x                Hysteria2 ▶  2.x.x
  Sing-box ▶  x.x.x             Mihomo    ▶  v1.x.x
  ──────────────────────────────────────────

Introduction

Proxy Stack Manager (PSM) is an all-in-one Bash-based management tool for Linux proxy servers. The psm command lets you install VLESS Reality / Vision / XHTTP, Shadowsocks, Hysteria2, Snell, and AnyTLS with a single command, powered by Xray, sing-box, and mihomo (Clash.Meta) triple cores, and centrally manage Nginx, SSL certificates, realm relay forwarding, per-node traffic monitoring with Telegram Bot notifications, VPS security hardening, Docker apps, and Cloudflare services.

Every node automatically generates its own key pair and can export share links and QR codes, with Clash Meta / Shadowrocket / Surge config export supported. Certificates are issued and renewed automatically via acme.sh — no manual steps required. Multiple protocol nodes can also share the same public port 443 (see below).

The interface is available in four languages — 简体中文 / English / 한국어 / Русский — chosen at install time and switchable any time from the main menu.

Why PSM

One command to enter the full management menu — after installation, just run psm
Triple cores — Xray, sing-box, and mihomo are managed side by side: protocol inbounds, routing rules, and outbounds are configured independently per core without interfering
Multi-protocol management — Reality / Vision / XHTTP / Hysteria2 / Snell / SS2022 / AnyTLS can coexist under one workflow, no per-protocol scripts to maintain
Designed for long-lived VPS instances — not a one-off installer, but a tool that keeps update, backup, restore, service status, and hardening in one place
Four-language interface — switch between Chinese / English / Korean / Russian any time; PSM_LANG=en psm overrides per session
Transparent and auditable — the project is Bash-based, installs under /opt/psm, and documents its system write paths

443 Port Reuse

Multiple protocol nodes can share the same public port 443 for external access — no need to open a separate port for every protocol or domain. This works via Nginx's stream-layer ssl_preread: it reads the SNI (the domain the client is trying to reach) straight out of the TLS ClientHello without decrypting the traffic, then routes the connection to the matching backend by domain.

flowchart TD
    A(["Client connects on 443/TCP"]) --> B["Nginx stream layer<br/>ssl_preread reads SNI (no decryption)"]

    B -->|"SNI = a.example.com"| C1["Reality node 1<br/>127.0.0.1:1443"]
    B -->|"SNI = b.example.com"| C2["Reality node 2<br/>127.0.0.1:1444"]
    B -->|"SNI = c.example.com"| D["Vision node<br/>127.0.0.1:1445"]
    B -->|"SNI = d.example.com"| E["XHTTP node<br/>127.0.0.1:1446"]
    B -->|"SNI = e.example.com (your own domain)"| F["HTTPS decoy site<br/>127.0.0.1:8443"]
    B -->|"SNI matches no entry"| X["Connection dropped<br/>no upstream connection opened"]

    G(["Client connects on 443/UDP"]) --> H["Hysteria2<br/>independent QUIC listener, no conflict"]

Benefits:

Only one port exposed externally — the firewall only needs to allow 443, shrinking the scannable attack surface
Unknown SNI is dropped — the routing table only knows domains that were explicitly mounted, so a scanner putting an arbitrary SNI on the wire is disconnected without any upstream connection being opened. That blackhole also closes the path to using your server as a free relay (see the FAQ entry on CDN-fronted decoy targets)
Multiple identities on one machine — different protocol nodes, plus the decoy site shown to GFW probing, can all live on 443 at once, distinguished purely by domain name
Multiple tenants per node — no need to open a separate port/key pair per user; multiple UUIDs under the same SNI share one entry point, with traffic billed independently per user
UDP 443 reuse is independent — Hysteria2 runs over UDP, a completely separate listening stack from the TCP routing above, so there's no conflict even though the port number is the same

Unified across cores: Xray's Reality / Vision / XHTTP plus sing-box and mihomo Reality / AnyTLS nodes can all mount on the same 443, sharing this one SNI routing table; reusing the same camouflage domain across cores is automatically detected and blocked to prevent routing conflicts.

How to Use

One-line install

Run as root on your VPS. This installs to /opt/psm and registers the psm command:

# Using curl (recommended)
bash <(curl -fsSL https://psm.jinqians.com)

# Using wget (if curl isn't installed)
bash <(wget -qO- https://psm.jinqians.com)

Running the same command again on a fully installed machine performs a git pull update. If a half-installed state left over from an old uninstall is detected, the installer re-runs automatically to repair it.

After installation, type at any time:

psm

to enter the interactive main menu.

Manual install

git clone https://github.com/jinqians/proxy-stack.git /opt/psm
bash /opt/psm/install.sh

System requirements

Distribution	Minimum supported version
Ubuntu	20.04 LTS or later
Debian	10 (Buster) or later
CentOS / RHEL	8 or later
Rocky Linux / AlmaLinux	8 or later
Oracle Linux	8 or later
Amazon Linux	2 or later
Fedora	recent supported releases

Systems not in this list, or older versions (CentOS 7, Debian 9, Ubuntu 18.04 and earlier), are untested and not guaranteed to work.

Item	Requirement
Privileges	root
Architecture	x86_64 · arm64
Base packages	`curl` or `wget` (either one) · `git` (installed by bootstrap)

Other dependencies (jq, openssl, qrencode, unzip, iptables, fail2ban, …) are installed on demand the first time each feature module is used.

══════════════════════════════════════════════════════════════
                  JQ's Proxy Stack Manager
══════════════════════════════════════════════════════════════
   1. System Management        12. Relay (realm)
   2. sing-box Management      13. Cloudflare DDNS
   3. mihomo Core              14. Docker Management
   4. Xray Management          15. Traffic Management
   5. Snell Management         16. Telegram Bot
   6. ss-rust Management       17. Backup Management
   7. Hysteria2 Management     18. Restore Backup
   8. Nginx Management         19. Update PSM
   9. Website Management       20. Security Hardening
  10. SSL Cert Management      21. 语言 / Language
  11. View All Nodes
──────────────────────────────────────────────────────────────
   0. Exit
══════════════════════════════════════════════════════════════

Non-interactive mode (for cron / systemd timers)

manager.sh --ddns-update           # Run one Cloudflare DDNS update
manager.sh --backup-full           # Run one full backup
manager.sh --backup-quick [label]  # Run one quick backup
manager.sh --update                # Update PSM scripts and components
manager.sh --traffic-check         # Run one traffic accounting check
manager.sh --tgbot                 # Start the Telegram Bot daemon
manager.sh --reality-watchdog      # Run one Reality decoy liveness check
manager.sh --vpngate-watchdog      # Check the VPNGate residential tunnel once, rotating nodes if it is down
manager.sh --ruleset-update        # Refresh subscribed rule sets once (restarts Xray if its content changed)
manager.sh --honeypot-alert <ip> <port>  # Honeypot hit alert (called by fail2ban)
manager.sh --health-report         # Send one daily health report

These are the real entry points invoked by each module's scheduled tasks. The "enable scheduled task" options in the menus register them for you — no manual cron setup needed.

Diagnostics and node automation CLI

psm doctor                         # Read-only host and configuration diagnostics
psm doctor --json                  # Structured JSON report

psm node list --json               # List nodes from all three cores
psm node show xray reality node-1 --json
psm node add xray reality --tag node-1 --port 24443
psm node update xray reality node-1 --port 25443
psm node export xray reality node-1 --server 203.0.113.10
psm node delete xray reality node-1 --yes

The node CLI covers 14 stored node types across Xray, sing-box, and mihomo, with JSON input, field-level updates, credential redaction by default, mutation locking, port-conflict checks, and rollback on apply failure. Run psm node help for the full option reference.

Uninstall

bash /opt/psm/uninstall.sh

The uninstaller removes the shortcut command, cron entries, systemd timers/services, and PSM firewall/Fail2ban rules created by PSM itself, and asks (default yes) whether to delete the /opt/psm program directory with its config state. Components such as Nginx, Xray, sing-box, mihomo, Hysteria2, Snell, ss-rust, acme.sh, certificates, and Docker Compose apps are confirmed one by one, so services you maintain manually are never removed by accident.

Features

Xray core

Xray — Reality / Vision / XHTTP / SS2022, multi-node management, automatic key pair generation, VLESS URI export (with QR code) / Clash Meta / sing-box
Reality multi-target liveness switching — configure multiple candidate SNIs for the decoy target; periodic real TLS 1.3 handshake checks switch away from dead targets automatically while old client links keep working
Smart Reality decoy discovery — when configuring a Reality / XHTTP decoy SNI, cyberspace mapping engines (Netlas / Quake / ZoomEye / FOFA, using your own API key, free tiers suffice) can discover real TLS 1.3 sites in the same ASN / same datacenter as your server: nearby, obscure, and free of the over-used big-brand domains. A host in your own ASN is also not a CDN edge, which sidesteps the abuse risk covered in the FAQ. Candidates are verified locally with real handshakes (TLS 1.3 / X25519 / certificate match) before being adopted, and can be batch-added to the liveness pool above. No local port scanning at any point (avoiding provider abuse reports) — discovery relies on the engines' datasets; without an engine configured, it falls back to manual input
Cloudflare WARP outbound unlock — register a WARP identity with one click and wire it into Xray outbounds; combined with routing rules, traffic for Netflix / OpenAI etc. is steered through WARP
VPNGate residential-IP exit — picks genuine home-broadband IPs out of the public VPNGate list (ip-api batch classification drops datacenter nodes and VPNGate's own relays), brings up a dedicated openvpn tunnel, and wires it in as an fwmark outbound: services that judge you by IP ownership (Netflix / ChatGPT ...) see a residential exit, while the box's own default route and SSH stay untouched (the tunnel only ever writes a dedicated routing table). If the tunnel drops, matching traffic fails closed instead of leaking back through the datacenter IP, and failover is automatic within the country you picked (chosen from a numbered list of the countries that actually have nodes), so the exit country never drifts. Xray / sing-box / mihomo share the one tunnel, so switching residential IP changes nothing in any core config
Subscribed rule sets — paste a community rule-list URL (OpenAI.list and friends), pick an exit, and the traffic it describes leaves there. Xray has no rule-set mechanism, so rules are inlined into config.json (domains and IPs as two separate rules — fields within one rule are ANDed, and merging them would mean the rule never fires), which also makes it the one core that needs a restart; the daily update only rebuilds and restarts when the content actually changed
Outbound routing — custom outbound nodes (VLESS-Reality / TLS / XHTTP, Shadowsocks, Trojan, SOCKS5), forwarding by domain / GeoIP / GeoSite rules to a chosen outbound

sing-box core (second core)

A full protocol stack parallel to Xray — VLESS Reality, SS2022, Hysteria2, AnyTLS (requires sing-box 1.12+), and Snell (requires sing-box 1.14+) inbounds sharing one kernel and one config file
Stable and preview channels for Xray — XTLS has marked every release since v26.3.27 as a pre-release, so the stable channel can lag months behind while preview tracks the newest build. Choosing preview warns you that from v26.4.13 REALITY refuses clients on a core older than v26.3.27 (including the cores bundled in many phone apps); the Reality menu lets you relax that per node
Stable and preview release channels — pick a kernel channel at install and upgrade time. Stable is the default; preview installs the latest beta/rc and is currently the only way to reach protocols upstream has not stabilised yet (the Snell inbound needs 1.14+, and 1.14 is still in beta). Switching back to stable while Snell nodes exist is blocked with an explanation, so the config cannot end up failing validation with the service down
Routing management — geosite / geoip / domain suffix / IP CIDR / inbound tag → chosen outbound or reject, with one-tap ad-block and QUIC-block presets
Outbound manager — 10 outbound types: ss / vless-reality / vless-tls / trojan / socks / anytls / snell / hysteria2 (Salamander obfuscation) / tuic
WARP outbound — reuses the WARP account registered on the Xray side as a WireGuard endpoint
Subscribed rule sets — paste a community rule-list URL (OpenAI.list and friends), pick an exit, and the traffic it describes leaves there. Uses the native rule_set path (a local source file the core reloads by itself on 1.10+), so refreshing never restarts anything. A preflight report shows usable counts and names every dropped client-only type (PROCESS-NAME and the like); updates compare rule counts and refuse wild swings pending review
VPNGate residential exit — shares the same residential tunnel as Xray; the outbound is direct + routing_mark, so rotating nodes needs no config change (sing-box 1.12+ switches to domain_resolver to pin IPv4)
443 port reuse — Reality and AnyTLS nodes can mount on the Nginx 443 SNI router, sharing the public 443 with Xray / mihomo nodes so clients only connect to 443; direct-listen on a dedicated port still works too
Transactional config changes — every change is preceded by an automatic backup; if sing-box check fails, both the config and the node store are rolled back, so a bad config can never take the service down

mihomo core (third core)

Clash.Meta ecosystem support — VLESS Reality, SS2022, Hysteria2, AnyTLS, and Snell v4/v5 inbounds share /etc/mihomo/config.yaml
Clash-style routing — manages proxies / proxy-groups / rules directly, supporting DOMAIN-SUFFIX / DOMAIN-KEYWORD / GEOSITE / GEOIP / IP-CIDR / IN-NAME with a fixed MATCH,DIRECT fallback
Outbound manager — ss / vless-reality / vless-tls / trojan / socks5 / anytls / snell / hysteria2 / tuic / wireguard outbound types
WARP outbound reuse — reuses the WARP account registered on the Xray side and generates a mihomo wireguard proxy
Subscribed rule sets — same feature on mihomo, emitted as a native rule-providers entry the core refreshes on its own interval; types only mihomo understands, such as IP-ASN, survive the native path
VPNGate residential exit — shares the same residential tunnel as Xray, generating a type: direct proxy with routing-mark and ip-version: ipv4; rotating nodes needs no config change
443 port reuse — Reality and AnyTLS nodes can mount on the Nginx 443 SNI router, sharing the public 443 with Xray / sing-box nodes so clients only connect to 443; direct-listen on a dedicated port still works too
Transactional config changes — every change rebuilds the config and runs mihomo -t -d /etc/mihomo -f /etc/mihomo/config.yaml; failed checks roll back automatically without affecting the running old config

Standalone protocols & relay

Hysteria2 — UDP proxy, password auth, bandwidth limits, masquerade
Snell — v4 / v5 / v6, PSK auth, Surge-format export
SS 2022 — standalone shadowsocks-rust deployment, ss:// URI export (with QR code)
realm relay — TCP / UDP port forwarding rule management (relay machine → landing machine), with relay server status reports via Telegram

Base services

Nginx — SNI-based multi-protocol routing, site management, HTTPS decoy sites
SSL certificates — automatic issuance via acme.sh (HTTP-01 / DNS-01 wildcard), automatic renewal
Cloudflare — dynamic DDNS updates, DNS record management, DNS-01 wildcard certificates
Cloudflare Tunnel — expose local services (Docker apps, admin panels, …) on a chosen domain without opening any port
Cloudflare Access — put an email-verification gate in front of domains exposed via Tunnel/Nginx, made for protecting admin apps like Portainer and Nginx Proxy Manager
Docker — install management, one-click app store (Portainer / Uptime Kuma / Netdata / AdGuard Home / Vaultwarden / Alist, …), pre-deploy port conflict detection, selectable exposure (localhost only / direct public / Nginx reverse proxy / Cloudflare Tunnel), data volumes included in backups

Security hardening

SSH hardening — one-click key-only login, password auth disabling, and port changes; every high-risk change is applied via reload (never killing your current session) with a 5-minute auto-rollback that reverts unless confirmed, so you can't lock yourself out
Fail2ban — automatic banning of failed SSH logins, built-in "recidive" rules imposing longer bans on repeat offenders, IP whitelist support
Honeypot — traps on ports this machine shouldn't be serving (RDP / MSSQL / Telnet, …); any connection is treated as reconnaissance, triggering a permanent ban and a Telegram alert. Port occupancy detection automatically excludes SSH, configured proxy protocols, Docker services, etc., so legitimate services are never caught

Operations & monitoring

Traffic management — covers nodes across all three cores (Xray / sing-box / mihomo); monthly quota per node, automatic pause at threshold with a Telegram alert, per-minute accounting, automatic monthly reset
Expiry management — per-node expiry dates, automatic reminders and service pause on expiry, one-click renewal
Daily health report — a scheduled Telegram digest: core-service status (Xray / sing-box / mihomo / Nginx, …), traffic warnings, expiry reminders, Reality liveness switches, SSH/BBR/Fail2ban/honeypot/WARP status — the whole picture in one message
Telegram Bot — query node traffic, manage user bindings, renew expiries, health reports — all from inside Telegram, no server login needed
Backup & restore — full / selective backups (including Docker volumes), scheduled backups, one-click restore
System management — BBR congestion control, sysctl network tuning, firewall, DNS, timezone, and common VPS test tools (local health, latency/route, NodeQuality, YABS, IP.Check.Place, RegionRestrictionCheck, bench.sh, LemonBench)
Multilingual interface — 简体中文 / English / 한국어 / Русский; chosen at install, switchable from the menu, with all 2000+ interface strings fully translated

Directory Layout

/opt/psm/
├── bootstrap.sh          # One-line install entry
├── manager.sh            # Main entry (interactive menu + non-interactive calls)
├── install.sh            # First-install wizard
├── update.sh             # Self-update and component upgrades
├── uninstall.sh          # Guided uninstaller
├── config/               # Runtime state and config (gitignored)
├── lang/                 # Language tables (zh / en / ko / ru)
├── lib/
│   ├── common.sh         # Shared utilities
│   ├── i18n.sh           # Multilingual framework
│   ├── xray/             # Reality / Vision / XHTTP / SS2022 / WARP / outbound routing / liveness / decoy discovery
│   ├── singbox/          # sing-box second core (Reality / SS2022 / Hysteria2 / AnyTLS / Snell / routing)
│   ├── mihomo/           # mihomo third core (Reality / SS2022 / Hysteria2 / AnyTLS / Snell / routing)
│   ├── vpngate/          # VPNGate residential exit (list, classification, openvpn tunnel, core wiring)
│   ├── ruleset/          # Subscribed rule sets (fetch, parse, preflight, apply to sing-box and mihomo)
│   ├── security/         # SSH hardening / Fail2ban / honeypot
│   ├── cloudflare/       # Tunnel / Access
│   ├── docker/           # Docker extensions (volume backup, …)
│   ├── tgbot/            # Telegram notification templates / daily health report / relay status
│   ├── expiry/           # Expiry management
│   ├── hysteria2.sh / snell.sh / ssrust.sh / realm.sh
│   ├── nginx.sh / cert.sh / cloudflare.sh
│   ├── docker.sh / system.sh / vps_test.sh / backup.sh / traffic.sh
│   └── tg_bot.sh
├── scripts/              # Dev helper scripts (i18n checks, …)
├── templates/            # Config templates (incl. Docker app store templates)
└── backup/               # Backup archives

Write Paths

PSM keeps its own state under /opt/psm as much as possible, but some features must write system services, certificates, firewall rules, or app configs. Common paths:

Path	Purpose
`/opt/psm`	PSM program, runtime state, config, backups, Docker Compose projects
`/usr/local/bin/psm`	Global shortcut command
`/etc/systemd/system/psm-.service` / `/etc/systemd/system/psm-.timer`	PSM scheduled tasks and daemons
`/usr/local/etc/xray` / `/usr/local/bin/xray`	Xray config and binary
`/etc/sing-box` / `/usr/local/bin/sing-box`	sing-box config and binary
`/etc/hysteria` / `/usr/local/bin/hysteria`	Hysteria2 config and binary
`/etc/realm` / `/usr/local/bin/realm`	realm relay config and binary
`/etc/nginx`	Nginx sites, stream routing, and SSL files
`/root/.acme.sh`	acme.sh account and certificate issuance cache
`/etc/fail2ban` / `iptables`	Fail2ban rules, honeypot, and traffic accounting chains
`/etc/cron.d/psm-*`	Cron entries for backup, DDNS, etc.

If you plan to use PSM on a production VPS, read the install output and uninstall prompts first; if the machine already carries important Nginx, Docker, or Cloudflare Tunnel configs, take a snapshot or manual backup beforehand.

FAQ

How do I switch the interface language?

Pick "21. 语言 / Language" in the main menu to switch between 简体中文 / English / 한국어 / Русский; the choice is persisted. PSM_LANG=en psm overrides the language for a single session.

What happens if I run the one-line install again?

If /opt/psm is a complete installation, the script performs a git pull update. If it detects a half-installed state left over from an old uninstall (e.g. .git present but the psm command or config directory missing), it automatically re-runs the install flow to repair it.

Xray, sing-box, or mihomo — which should I use?

They are independent, parallel cores. Xray has the richest tooling (liveness watchdog, decoy discovery, traffic accounting); sing-box covers more protocols (AnyTLS, native Snell inbound) with a more modern routing config; mihomo fits Clash.Meta routing and client config workflows (proxies / proxy-groups / rules). Use any one of them, or run several at once — each manages its own ports and nodes.

Why does the uninstaller let me keep certain components?

Nginx, Docker, certificates, Cloudflare Tunnel, etc. may be shared with other sites or services. The uninstaller removes PSM's own traces by default and confirms each shared component one by one.

My log shows "REALITY: Listening on non-443 ports" — is that a problem?

Not under 443 port multiplexing; the warning is expected there. Since v26.3.27 Xray warns about any REALITY inbound listening on a non-443 port, because in a direct-connection setup a non-443 port really is easier for the GFW to fingerprint. But in PSM's multiplexing mode the node listens on a loopback port on 127.0.0.1 (1443, 2443, and so on) and Nginx forwards to it from public port 443 by SNI — the port exposed to the internet is 443, so the risk the warning describes does not apply.

If a node is not mounted behind the Nginx 443 split and instead listens on a public non-443 port directly, the warning is a genuine one: move it to 443 or put it behind port multiplexing.

The same version can emit two other REALITY warnings: one when the camouflage target contains apple / icloud / microsoft or ends in .cn / .ru / .ir (pick a different domain), and one from v26.4.13 about the default minimum client core version (see the Xray kernel section above).

Can the decoy target (`dest` / SNI) be a site behind Cloudflare?

Not recommended — and PSM warns you about it during configuration.

REALITY's camouflage works by forwarding every connection that fails authentication to the decoy target (dest) untouched, so a prober sees a genuine website's full TLS response. That forwarding is unconditional: it looks neither at the source nor at what the ClientHello asked for.

The problem starts when dest lands on a multi-tenant CDN edge (Cloudflare, Fastly, Akamai, …). Those IPs serve any tenant by SNI, so anyone who scans your port 443 only has to put some other hostname on that CDN into the ClientHello to get a tunnel into the entire CDN through your box — your server becomes a free port forwarder for the CDN, on your bandwidth and your bill. The Xray documentation warns about exactly this.

PSM handles it in three layers:

No decoy domain ships as a default — the default camouflage SNI is empty on all three cores, so no crowd of installs shares one factory default (which could move behind a CDN later anyway). Xray's discovery prefers targets in the same ASN, and a host in your own datacenter is not a CDN edge; sing-box and mihomo have no discovery path, so they require an explicit target, and the non-interactive CLI fails with a message instead of building a node on a borrowed default
A probe at configuration time — after you enter dest, PSM connects to the same IP using a set of unrelated probe hostnames as SNI. If a valid certificate comes back for a hostname the target does not own, it is flagged as a shared frontend. This tests the property that actually matters (does this IP serve arbitrary tenants?) rather than tracking CDN IP ranges or ASNs. It warns rather than blocks — the verdict can misfire, and the risk is yours to weigh
Two backstops — under 443 port reuse, unknown SNI is dropped at the Nginx layer, so a prober must use the node's real camouflage domain to reach REALITY at all, and that SNI forwarded to dest only ever returns dest's own site. And if you proceed past the warning, Xray / mihomo nodes get REALITY fallback rate limiting written in automatically (limitFallback* / limit-fallback-*)

Two known gaps worth knowing: limitFallback is per connection, so an abuser who reconnects in a loop bypasses it — it is a backstop, not a fix. And sing-box's reality inbound has no equivalent option at all, which makes "sing-box + direct-listen port + CDN-fronted dest" the weakest combination; PSM prompts you to switch to 443 port reuse when it sees one. The real fix is always to pick a decoy target that is not behind a CDN.

Network	QR	Address
TRC20		`TUe1x22n9FPAgLt6YFcQyxWgvTZFNgKBgM`
Polygon		`0x5632f6d76a03543c53d750918c9c6a4c372f1597`

Thanks to every supporter!

License

This project is released under the GNU Affero General Public License v3.0 (AGPL-3.0).

JQ's Proxy Stack Manager

JQ's Proxy Stack Manager

Introduction

Why PSM

443 Port Reuse

How to Use

One-line install

Manual install

System requirements

Main menu

Non-interactive mode (for cron / systemd timers)

Diagnostics and node automation CLI

Uninstall

Features

Xray core

sing-box core (second core)

mihomo core (third core)

Standalone protocols & relay

Base services

Security hardening

Operations & monitoring

Directory Layout

Write Paths

FAQ

How do I switch the interface language?

What happens if I run the one-line install again?

Xray, sing-box, or mihomo — which should I use?

Why does the uninstaller let me keep certain components?

My log shows "REALITY: Listening on non-443 ports" — is that a problem?

Can the decoy target (`dest` / SNI) be a site behind Cloudflare?

Will it overwrite my existing Nginx configuration?

Can I install without root?

Is it suitable for managing many servers centrally?

Project Links

Donate

License