InternetSpeed personal Xray guide

Requires a clean Ubuntu VPS (x86_64 or ARM64), public IPv4,
root SSH access, and free TCP port 443. Xray version: 26.3.27.
Installation was tested on Ubuntu 26.04 LTS.
No panel, public subscription service or domain purchase is required.

Extract all files before running. On your computer, open a terminal in this folder.
Windows: open the extracted xray-guide folder in File Explorer. Click its
address bar, type powershell and press Enter. In that window, run:
  .\Connect-XrayServer.ps1
macOS/Linux:
  bash ./connect-xray-server.sh

If PowerShell says the file is not digitally signed, unblock it and retry:
  Unblock-File -LiteralPath .\Connect-XrayServer.ps1
If running scripts is disabled, run these commands, confirm and retry:
  Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
  Unblock-File -LiteralPath .\Connect-XrayServer.ps1
The policy change lasts only for this window. If a policy error remains, keep
the message for troubleshooting. Review scripts before running them.
OpenSSH must be installed; passwords are handled by SSH.
Use the same launcher again and choose Manage devices to open the server menu.
Setup displays your private connection link and saves it under your home folder:
Xray/SERVER_IP/my-xray-vpn.txt (or the profile name you choose).
Copy the complete vless:// link from the terminal or that file. In Hiddify,
click + and choose Add from clipboard.
A profile is a set of connection details and access credentials. Create one
per device so you can remove access for a lost phone without changing the others.
Profiles and QR codes are passwords. Do not share them publicly.
Device changes restart Xray briefly. Existing profiles keep their identities.

The menu offers add, list, show link, QR, revoke, check, backup and a pinned update.
Updates install only the version tested with the downloaded bundle, not arbitrary
latest releases. Download a new reviewed bundle to obtain a later approved version.
Run Set up server again with your existing device name to refresh the management
script, then choose Update in its menu. Existing profile credentials are preserved.
Backups are stored on the server, not on your computer. To copy one locally:
  scp root@SERVER_IP:/etc/internetspeed-xray/backups/EXACT_FILENAME.tar.gz .
Use scp -P PORT for a custom SSH port and -i KEY_PATH for a specific SSH key.
Keep backups private. Restoration on a new server is not automated in this version.

AUTOMATIC REALITY DESTINATION SELECTION - WHAT YOU NEED TO DO

You do not need to choose a website or run network test commands.
1. Enter your server IP, choose Set up server, and provide your SSH login.
2. Accept my-xray-vpn or enter a profile name, then confirm installation.
3. Leave the terminal open. Testing can take several minutes if sites time out.
4. Wait for "Selected REALITY destination" and for setup to finish.
5. Copy the vless:// link into Hiddify (+ then Add from clipboard).

For a new installation, the script tries these candidates in order:
  www.google.com            - the primary destination tested for this guide
  www.googletagmanager.com  - default site/SNI in Amnezia's source code
  dl.google.com             - mentioned in the REALITY authors' guidance
  www.cloudflare.com        - an additional candidate on a different network

Each candidate must pass a TLS 1.3/HTTP/2 check AND a real REALITY connection
with HTTPS traffic. Tests use temporary loopback-only listeners and credentials.
The first successful candidate is saved. The script does not keep switching
sites later, because existing device profiles contain the saved hostname.
On rerunning setup, an existing installation keeps its destination and profiles.
Specifying a custom hostname disables automatic fallback for that attempt.

The www prefix is part of a hostname. google.com redirects to www.google.com,
so the primary candidate uses the final hostname. These websites are destinations
for REALITY's handshake, not your VPN provider; VPN traffic exits through your VPS.
No candidate is guaranteed to work through every internet provider. Three
candidates use Google infrastructure; Cloudflare adds network diversity.
Our test VPS successfully completed REALITY/HTTPS checks with all four candidates.
That does not prove that every candidate is suitable for every country or network.

IF EVERY CANDIDATE FAILS

No working profile is issued. Do not enter random domains or reinstall Ubuntu.
1. Keep the "Destination check failed" lines and the final error message.
2. Check for an outage or network restrictions in your hosting account. Ask the
   provider whether outbound HTTPS (TCP 443) and DNS work from this VPS. This
   matters especially when all candidates report timeouts or DNS failures.
3. If the network problem was temporary, rerun the same launcher with the same
   server and profile name. An unfinished automatic selection will be retried.
4. If it still fails, share the error text for troubleshooting. Do not share
   passwords, SSH keys, vless:// links, QR codes or backup archives.

The error can also be a local test-process problem, not just a blocked website.
Errors installing Ubuntu packages or downloading Xray are separate: changing
the destination will not fix them. If the server checks pass but your phone
cannot connect, check the phone's network, profile and provider firewall.

OPTIONAL: CHOOSE YOUR OWN DESTINATION

Only use this if you have a suitable candidate or technical assistance.
Choose a public HTTPS hostname reachable from your VPS, supporting TLS 1.3 and
HTTP/2, without a redirect to another hostname. A nearby destination is preferred.
A website opening in your browser alone does not prove it is suitable for REALITY.
Replace REALITY_HOST with the hostname only (no https://, path or port):

Windows:
  .\Connect-XrayServer.ps1 -RealityTarget REALITY_HOST
macOS/Linux:
  XRAY_TARGET=REALITY_HOST bash ./connect-xray-server.sh

These commands are for initial setup, not migration of an existing installation.
The script performs the same connection checks for your custom destination.

Sources:
https://github.com/XTLS/REALITY/blob/main/README.en.md
https://github.com/amnezia-vpn/amnezia-client/blob/dev/client/core/utils/constants/protocolConstants.h

CHECKING THE SERVER

Run the launcher, choose Manage devices, then Check server. This checks Xray
and a test connection from the VPS. It cannot check your phone's network or
Hiddify settings. After a successful check, try opening a website on your device.

BACKUPS AND UPDATES

A backup preserves server settings and device credentials for manual recovery.
Automatic restoration will be added later. If you start again without restoring,
you will need new profiles on your devices. Updates apply fixes in a new bundle;
there is no need to run an update on every connection.

ADVANCED LAUNCHER INPUTS
Windows: -Server IP -Action install|menu -IdentityFile PATH -Port PORT
         -ProfileName NAME -RealityTarget HOST -ConfirmInstall
macOS/Linux: bash ./connect-xray-server.sh IP install|menu
Optional environment: XRAY_SSH_KEY, XRAY_SSH_PORT, XRAY_DEVICE, XRAY_TARGET.
Default REALITY selection: auto. The saved destination is reused on later runs.
Setup verifies a real REALITY/HTTPS connection before exporting a profile. This is not proof of reachability from every client network.

Server CLI (root): python3 /root/internetspeed-xray/server.py ACTION [VALUE]
Actions: ensure NAME, list, show NAME, qr NAME, remove NAME, check, backup, update, menu.
Server state: /etc/internetspeed-xray (root-only).
Service: internetspeed-xray.service; binary: /usr/local/lib/internetspeed-xray/xray.
The service uses systemd DynamicUser and a read-only configuration credential.
The installer preserves existing UFW rules and permits SSH plus TCP 443.
Provider firewalls must also permit SSH and TCP 443. No forwarding/NAT is needed.
Outbound private/metadata destinations and SMTP ports 25,465,587 are blocked.
The default server egress is IPv4. Configure and test client IPv6/DNS behavior.
An installation failure never prints success. Do not delete partial state blindly;
read the error and inspect the installation. OS updates remain your responsibility.

Validation limits and exact device tests are listed in the accompanying article.
