# ai-xray

Scripts and configs for benchmarking Xray proxy configurations to the Juris remote server (`83.99.190.32`).

## Purpose

Find the best-performing Xray protocol and transport combination for a VPN tunnel between the local Agap server and the Juris remote server, optimising for latency, throughput, and anti-DPI evasion.

## What Was Tested

Compared multiple Xray configurations on the same server pair:

- **VLESS + TCP + Reality + Vision** (classic Reality setup)
- **VLESS + XHTTP + Reality** (newer HTTP-based transport)
- Various SNI targets for Reality camouflage (`www.delfi.lv`, `www.lmt.lv`, `www.inbox.lv`, `e-klase.lv`)
- Multiple TLS fingerprints (`chrome`, `firefox`, `safari`)

## Scripts

| Script | Purpose |
|--------|---------|
| `test_xray_connection.sh` | Basic connectivity test to the remote server |
| `test_sni_configs.sh` | Test latency and throughput across different SNI targets |
| `test_all_configs.sh` | Full benchmark across all protocol/transport combinations |
| `benchmark_improvements.sh` | Iterative improvement benchmark |

## Results

See `sni_test_results.md`, `config_test_results.md`, and `improvement_results.md` for full benchmark output.

**SNI winner**: `www.delfi.lv` (121ms avg latency) — used as both Reality destination and serverName.

**Protocol winner**: **VLESS + XHTTP + Reality** — lowest latency (142ms avg, 225ms P95), best upload throughput vs TCP+Reality+Vision.

## Final Configuration

### Server (Juris — `share.alogins.net:443`)

Running inside an LXD container (`lxc exec xray`) on the Juris host.

| Setting | Value |
|---------|-------|
| Protocol | VLESS |
| Transport | XHTTP |
| Security | Reality |
| Reality destination | `www.delfi.lv:443` |
| Allowed SNIs | `www.delfi.lv`, `www.lmt.lv`, `www.inbox.lv`, `e-klase.lv` |
| XHTTP path | `/xt-6036d37d` |
| XHTTP mode | `auto` |
| xmux concurrency | 16-32 streams, 64-128 reuse times |
| Padding | 100-1000 bytes |

### Client (Agap — local x-ui)

| Setting | Value |
|---------|-------|
| Outbound tag | `juris-xhttp` (primary) |
| Server | `share.alogins.net:443` |
| Transport | XHTTP, path `/xt-6036d37d` |
| Reality SNI | `www.delfi.lv` |
| TLS fingerprint | `chrome` |
| UUID | `6e422ab5-070a-43f6-8241-38cd56d23d24` |

A fallback outbound `juris-reality` (VLESS + TCP + Reality + Vision) is also configured but has no routing rules assigned.

## Infrastructure

See `xray_config.md` for full server/client configs, credentials, API usage, and routing rules.

| Role | Host | Details |
|------|------|---------|
| Client | Agap (`95.165.85.65`) | x-ui 2.8.10, Xray 25.10.15 |
| Server | Juris (`83.99.190.32`) | LXD container `xray`, x-ui 2.8.10, Xray 26.2.6 |