From 6e84e26d2d5c238395273efd0e70a299f055c7a7 Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Mon, 13 Jul 2026 03:05:48 +0300
Subject: [PATCH] heather: xray VLESS+Reality proxy on :8443

Add xray-core container (ghcr.io/xtls/xray-core) to arion compose.
VLESS + Reality + xtls-rprx-vision, masquerades as www.microsoft.com.
Config (UUID + Reality privateKey) at /var/lib/xray-secrets/config.json
(outside git, root:docker 0640). Public port 8443, not behind Caddy.
Secrets in pass iscg.dev/xray/. Client: v2RayTun / v2rayN.
---
 hosts/heather/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix
index 1d98f83..46afe3b 100644
--- a/hosts/heather/default.nix
+++ b/hosts/heather/default.nix
@@ -45,6 +45,7 @@
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
       3478    # coturn TURN (tcp+udp)
+      8443    # xray VLESS+Reality (публичный прокси)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)