yonggekkk/cloudflare-vless-trojan

This repository is a Chinese-language toolkit for setting up personal proxies through Cloudflare. It bundles two main approaches. The first is a local script, also offered as the Docker image ygkkk/cfsh, that runs on a home router or a small Linux box and turns Cloudflare Workers or Pages into a Socks5 or HTTP proxy. The second is a set of Cloudflare Workers and Pages scripts that you deploy to your own Cloudflare account to host VLESS or Trojan proxy nodes. The local script supports three proxy modes: ECH-TLS, regular TLS, and no TLS. The README explains that ECH adds extra encryption at the TLS handshake stage, and that the script lets you pick which port system to use, 80 series or 443 series, with specific port numbers listed. You configure it through a small set of variables, such as the Cloudflare domain and port, an optional token, a local client port, a preferred IP or domain, an optional ProxyIP, the DNS-over-HTTPS endpoint, and switches for ECH and for split-tunnel routing between traffic inside and outside China. The Workers and Pages deployment path is aimed at less technical users. Default node IPs are official Cloudflare addresses, so the README says you do not need to constantly refresh subscriptions to get new optimized IPs. You set a UUID for VLESS or a password for Trojan, optionally a ProxyIP for reaching Cloudflare-blocked sites like X, ChatGPT, or Cloudflare's own pages, and optionally up to thirteen preferred IPs with matching ports for subscription links. The README notes that path-based ProxyIP only affects the single node where it is set, while a global ProxyIP affects all nodes that have not overridden it. There is a section about building your own ProxyIP or reverse-proxy IP using the REALITY protocol on a cheap IPv6 VPS near China, with links to two sibling scripts called x-ui-yg and sing-box-yg. The README lists official Cloudflare IP ranges and points to several Windows tools for testing and picking the fastest IP. The last sections cover client app recommendations and the fragment trick used to slip TLS nodes past blocked Workers domains. Supported clients include v2rayNG and Nekobox on Android, v2rayN and Hiddify on Windows, Karing and Shadowrocket on iOS, and Passwall on routers. Many links point to YouTube tutorials.