VLESS
Any share-link shape is accepted: plaintext, TLS, or REALITY; raw TCP, WebSocket, gRPC, HTTPUpgrade, or XHTTP.
Configuration
Enable with vless_enabled: true and a full vless_uri share link on Create Monitor.
Format
vless://<uuid>@<host>:<port>?<query params>#<remark>| security | query | `none`, `tls`, or `reality`. |
| sni / peer | query | TLS server name (SNI). |
| fp | query | TLS client fingerprint to impersonate, e.g. `chrome`. |
| flow | query | `xtls-rprx-vision` or `xtls-rprx-vision-udp443` — only valid on raw TCP + TLS/REALITY. |
| encryption | query | `none` (default) or a post-quantum encryption string. |
| pbk | query | REALITY public key. |
| sid | query | REALITY short id. |
| spx | query | REALITY spider-x path. |
| type / net | query | Transport: `tcp` (default), `ws`, `grpc`, `httpupgrade`, `xhttp` (alias `splithttp`). |
| path | query | WS/HTTPUpgrade/XHTTP path. Append `?ed=2560` to the path for WS/HTTPUpgrade early data. |
| host | query | HTTP Host header for WS/HTTPUpgrade/XHTTP. |
| mode | query | XHTTP mode: `auto` (default), `packet-up`, `stream-up`, `stream-one`. gRPC: `multi` for multi-mode. |
| extra | query | XHTTP only — a URL-encoded JSON object merged into xhttpSettings verbatim (advanced tuning). |
| serviceName | query | gRPC service name. |
| allowInsecure / insecure | query | Skip certificate validation — see the callout below. |
Example — REALITY with Vision flow
vless://[email protected]:443?security=reality&sni=www.microsoft.com&fp=chrome&pbk=yPJoJaYVDxdFDl-TVq4zQ3JDKkOSiOLVQZR3_OdPaTc&sid=abcd1234&flow=xtls-rprx-vision#My+NodeExample — TLS + XHTTP
vless://[email protected]:443?security=tls&sni=vpn.example.com&type=xhttp&path=%2Fapi&mode=stream-one#XHTTP+NodeA self-signed certificate (
allowInsecure=1) is honored by pinning that exact certificate’s fingerprint for the check, rather than genuinely skipping validation — functionally equivalent, but it means a certificate that later changes (even to another self-signed one) will correctly show as down.Plaintext VLESS (no TLS, no REALITY) to a public address is refused by policy on modern relay engines — expect it to only work against private/internal addresses, or add TLS/REALITY.