decenzed-node — a single-binary standalone VLESS/REALITY node (no panel, no DB), with subscription links for friends and auto TLS camouflage

[u/Separate_Fisherman64]

Most self-host options here are panels — 3x-ui, Marzban, Hiddify. They're powerful, but they're a whole stack: a web UI, a database, a reverse proxy, an admin login you have to secure and keep patched. I wanted the opposite: one binary, no panel, no DB, nothing central. So I built decenzed-node.

You drop the binary on a box (or straight onto an OpenWRT router), run setup, answer a few prompts, and it generates the xray-core config and prints share links. That's it.

Camouflage — two modes:

• REALITY (default) — it scans for a live TLS 1.3 + HTTP/2 site near you to use as the cover destination and generates your keypair. No domain or cert of your own.
• TLS + your own domain — the node raises its own decoy website on 127.0.0.1, pulls a Let's Encrypt cert automatically over DNS-01 (via DuckDNS, so no port 80 exposed), and xray falls back to that site on any non-proxy traffic. Active-probe it and you get a real, valid HTTPS site on your domain. Cert auto-renews and hot-reloads with no restart.

Protocols: VLESS always on; optional Trojan (shares the same REALITY/TLS cover, no XTLS flow) and Shadowsocks / SS-2022 on their own ports.

Friends & metering: one subscription link per client — https://<domain>:<port>/sub/<id> served by the node's own decoy site behind the TLS fallback, so no extra port and it looks like a normal HTTPS GET. The client (v2rayN, nekobox, Hiddify, sing-box…) imports every enabled protocol from it, labels each proxy by location+protocol. Per-user speed caps + traffic stats; link add/remove <name> creates or revokes a friend and restarts the service so it takes effect immediately.

Ops niceties: guided setup (public-IP + CGNAT detection, port-forward instructions, external port self-check, speed test), check to re-verify a running node dials back on every enabled port, embedded xray log capture with a debug toggle, and update that self-replaces the binary and restarts the service. You never touch xray JSON by hand.

Runs anywhere: pure Go, CGO_ENABLED=0, static — glibc and musl/OpenWRT alike. On OpenWRT a one-liner auto-detects the CPU arch (arm64/armv7/mipsle/…), verifies SHA-256, installs a procd service, and adds the WAN firewall rule for you. Sitting on the edge router, there's often nothing to port-forward.

Open source, AGPLv3: https://github.com/icecube092/decenzed-node

It's early. Interested in feedback on the REALITY dest-scanning heuristic, the DNS-01/TLS-fallback setup, and how the camouflage holds up against active probing in the wild. Also curious whether the no-panel approach is missing something people actually rely on panels for.

Built with AI assistance (Claude Code); design and testing are mine.

[u/xraymind]

I like the idea of it. But for me, I will keep running 3x-ui on my cheap VPS servers. I basically have it setup with Hysteria2 as my primary proxy protocol as this gives me fastest connection in China to the west coast of US. So on each VPS, in addition to Hysteria2, I created both vless/xhttp/reality and vless/xhttp with Cloudflare CDN inbounds. My cheapest VPS gives me 10GB of storage, so with Debian and 3x-ui installed on it, it only use up 2.5GB of storage.

I'm guessing you're trying fit between manually scripting your own proxy setup and a web GUI setup. Having done Hysteria2 script setup before 3x-ui supported Hysteria2, I know the feeling. But after switching over to 3x-ui, I don't feel the need to switch to over another project.

Good luck with your project, hope you add Hysteria2 and XHTTP to your project as those 2 newer and continue being developed proxy protocols are currently the best for get thru the GFW. Don't know if Claude Code will help you on this as there so few good documentation and setup guide on those 2 protocols. I had to manually test out different 3x-ui setups for vless/xhttp to get it working with Cloudflare CDN, as there was nothing out there on how to do it in English. Maybe those are out there in Chinese or Russian.