Deploy a hardened VLESS+Reality proxy server with 3x-ui, Xray-core, and Cloudflare WARP on Ubuntu 22.04/24.04.
What you get: VLESS+Reality on port 443, auto-generated Reality keys, and server hardening
(BBR, fail2ban, UFW, DNS-over-TLS). Egress goes through Cloudflare WARP by default; set
warp_enabled=false (Ansible) or WARP_ENABLED=false (setup.sh) to skip WARP and egress from
the server's own address.
The Ansible path also installs the management scripts and three systemd timers — weekly updates,
daily backups, and a health check every 15 minutes that alerts to Telegram only when something is
wrong. setup.sh deploys neither of these; run scripts/deploy.sh afterwards to add them.
Both paths probe WARP after configuring it and report when the proxy is not carrying traffic. Only
Ansible with warp_required=true turns that into a failed deploy. Ansible is fully idempotent;
setup.sh is safe to re-run but redoes work. The Bash library is covered by 175 unit tests that
run on every push.
ssh root@YOUR_SERVER
curl -sL https://raw.githubusercontent.com/itslavrov/vlessbox/main/setup.sh | bashUnattended, with defaults — piping into bash means the script cannot prompt. Telegram, SSL and
WARP_ENABLED are set through environment variables; see the
installation guide.
cd ansible/
cp inventory.example inventory.ini # set the host IP and admin_allowed_cidrs
cp group_vars/vault.yml.example group_vars/vault.yml
ansible-vault encrypt group_vars/vault.yml
ansible-playbook site.yml --ask-vault-passadmin_allowed_cidrs has no default — it is the list of networks allowed to reach the 3x-ui panel
and the subscription port. The play stops at an assert until you set it.
See Installation guide for details and comparison.