{
    "log": {
        "loglevel": "debug",
        "access": "MY PATH/xray_log/access.log",
        "error": "MY PATH/xray_log/error.log",
        "dnsLog": false
    },

  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "MY_ID",
            "level": 0,
            "email": "",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "/dev/shm/xhttp_client_upload.sock",
            "xver": 0   
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "/dev/shm/nginx.sock",
          "xver": 0,  
          "serverNames": [
            "a.my.site"
          ],
          "privateKey": "MY_KEY",
          "shortIds": [ "MY_SHORTID"]
        },
        "sockopt": {    
          "tcpFastOpen": true,
          "tcpcongestion": "bbr",
          "tcpMptcp": true,
          "tcpNoDelay": true
        }
      },
  "tag": "VISION+REALITY",
      "sniffing": { 
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "metadataOnly": false,
        "routeOnly": true
      }
    },
    {
      "listen": "/dev/shm/xhttp_client_upload.sock,0666",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "MY_ID2",
            "level": 0,
            "email": ""
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "host": "",    
          "path": "/MYADRESS
          "mode": "auto",  
          "extra": {   
            "noSSEHeader": false, 
            "scMaxEachPostBytes": 1000000,   
            "scMaxBufferedPosts": 30,  
            "xPaddingBytes": "100-1000"
          }
        },
        "sockopt": {
          "tcpFastOpen": true,
          "acceptProxyProtocol": false, 
          "tcpcongestion": "bbr",
          "tcpMptcp": true,
          "tcpNoDelay": true
        }
      },
      "tag": "XHTTP_IN",
      "sniffing": {  
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "metadataOnly": false,
        "routeOnly": true
      }
    }
  ],

"outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {}
    },
    {
      "tag": "blocked",
      "protocol": "blackhole",
      "settings": {}
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "blocked"
      }
    ]
  }
}

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    set_real_ip_from    unix:;
    real_ip_header      X-Forwarded-For;
    real_ip_recursive   on;

    log_format  custom  '$remote_addr $remote_user [$time_iso8601] "$request_method $ssl_server_name'
                        '$uri $server_protocol" $status $body_bytes_sent'
                        'B "$host" "$http_user_agent" $request_time'
                        'ms $upstream_response_time'
                        'ms';
    access_log     on;
    log_not_found  off;


    sendfile              on;
    server_tokens         off;
    tcp_nodelay           on;
    tcp_nopush            on;
    client_max_body_size  0;
    gzip  on;

    add_header X-Content-Type-Options nosniff;


    ssl_session_cache          shared:SSL:16m;
    ssl_session_timeout        1h;
    ssl_session_tickets        off;
    ssl_protocols              TLSv1.3 TLSv1.2;
    ssl_ciphers                TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA>
    ssl_prefer_server_ciphers  on;
    ssl_stapling               on;
    ssl_stapling_verify        on;
    resolver                   1.1.1.1 8.8.8.8 valid=60s;
    resolver_timeout           2s;

    map $remote_addr $proxy_forwarded_elem {
        ~^[0-9.]+$        "for=$remote_addr";
        ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
        default           "for=unknown";
    }

    map $http_forwarded $proxy_add_forwarded {
        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF]>
        default "$proxy_forwarded_elem";
    }


    server {
        listen       unix:/dev/shm/nginx.sock ssl http2;
        server_name  b.my.site;

        ssl_certificate            MY PATH/fullchain.crt;
        ssl_certificate_key        MY PATH/private.key;
        ssl_trusted_certificate    MY PATH/ca.crt;

        location / {
            root MY PATH/www/webpage;
            index index.html;
        }
    }


    server {
        listen       unix:/dev/shm/nginx.sock ssl http2 backlog=2048 so_keepalive=on;
        server_name  b.my.site;

        ssl_certificate           MY PATH/fullchain.crt;
        ssl_certificate_key       MY PATH/private.key;
        ssl_trusted_certificate   MY PATH/ca.crt;

        error_log  /var/log/nginx/error_xhttp.log error;
        access_log /var/log/nginx/access_xhttp.log custom buffer=16k flush=5s;

       
        http2_max_concurrent_streams 1024;
        http2_body_preread_size      128k;
        keepalive_timeout            600s;
        keepalive_requests           2048;
        client_body_buffer_size      1m;
        client_body_timeout          600s;
        client_header_timeout        300s;
        large_client_header_buffers  8 16k;
        proxy_connect_timeout        30s;
        proxy_read_timeout           2h;
        proxy_send_timeout           2h;
        proxy_buffering              off;

        proxy_request_buffering      off;

        
        location / {
            root MY PATH/www/webpage;
            index index.html;
        }

        
        location /MY ADRESS {
           
            grpc_buffer_size         16k;
            grpc_socket_keepalive    on;
            grpc_read_timeout        1h;
            grpc_send_timeout        1h;

            grpc_set_header Connection         "";
            grpc_set_header X-Real-IP          $remote_addr;
            grpc_set_header Forwarded          $proxy_add_forwarded;
            grpc_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
            grpc_set_header X-Forwarded-Proto  $scheme;
            grpc_set_header X-Forwarded-Port   $server_port;
            grpc_set_header Host               $host;
            grpc_set_header X-Forwarded-Host   $host;

            grpc_pass unix:/dev/shm/xhttp_client_upload.sock;
        }
    }

server {
                listen 80;
                listen [::]:80;
                server_name .my.site;
                return 301 https://server_name$request_uri;
        }