Xray VPN OneClick: a TypeScript CLI that deploys VLESS+Reality on a fresh Linux box

What Xray VPN OneClick actually removes from the setup

Running Xray by hand is not hard, but it is fiddly. You pick a protocol, generate a UUID and an x25519 key pair, decide whether you need a domain and a TLS certificate, write a JSON config, wire it into systemd, then repeat half of that every time you add a user. Xray VPN OneClick packages that sequence into one installer and one CLI. The README states the goal plainly: five minutes to a working VLESS+Reality server, with UUIDs and keys generated for you.

The audience is narrow and specific. You need a Linux host with a public IP and at least 512 MB of RAM, on Ubuntu 22.04+, Debian 11+ or CentOS 9+. In return you get a server you administer yourself, which is the point for people who want a proxy endpoint they control rather than a subscription to someone else's. The repository also ships a REST API and Telegram notifications, so the tool is aimed at someone running this for a handful of users, not just for themselves.

Reality instead of a domain, and what the installer leaves behind

The protocol choice is the substance of the project. VLESS is the transport, and XTLS-Reality is the camouflage layer. Reality borrows the TLS handshake of a real site you nominate, so the server presents a certificate that matches that site without you buying a domain or issuing a certificate. The README claims traffic is indistinguishable from a normal TLS 1.3 connection and that active probing cannot identify it. Those are the project's claims, not measurements I can reproduce here.

The repository layout shows a TypeScript CLI compiled by esbuild into dist/, with the npm package exposing two binaries, xray-manager and xm, both pointing at dist/cli.mjs. Runtime dependencies include @inquirer/prompts and ink for the interactive interface, commander for argument parsing, qrcode-terminal for share links, and update-notifier, which means the CLI checks npm for newer versions when you run it. There is a tests/ directory with vitest configured, and examples/config.json plus examples/config-multiple-users.json showing the shape of the generated configuration. The install path itself is a shell script under scripts/, not the Node code, so the npm route and the wget route reach the same place by different roads.

Installing Xray VPN OneClick and adding a second user

The README's fastest path is a wget of the installer followed by sudo bash. It downloads the script to the current directory and runs it as root, which is what lets it install packages, write the Xray config, and register a systemd unit.

wget https://raw.githubusercontent.com/DanOps-1/Xray-VPN-OneClick/main/scripts/install.sh -O xray-install.sh && sudo bash xray-install.sh

When the script finishes, the README says the server is deployed with systemd integration and auto-start on boot, and the CLI prints a share link you can import into a client. If you prefer npm, the README gives this sequence, which needs Node.js 18 or newer and runs the privileged install step as a separate command.

npm install -g xray-manager && sudo xm install

There is also a git clone route. It pulls the repository, changes into the scripts directory, and runs the same installer from the checkout, which is the version to use if you want to read the script before executing it.

git clone https://github.com/DanOps-1/Xray-VPN-OneClick.git && cd Xray-VPN-OneClick/scripts && sudo bash install.sh

After installation the interactive manager is the working surface. The README describes service management, user management and traffic quota screens, and the package exposes both `xray-manager` and the shorter `xm` as entry points, so adding a second user is a menu action rather than a config edit.

Where the one-click approach breaks down

The main limitation is the one the README does not discuss: root. Both install routes end in sudo, and the npm route is worse in that respect. `npm install -g xray-manager` installs a package whose install step is a separate privileged command, `sudo xm install`, so the trust boundary sits between npm and your shell rather than inside a script you read first. If you cannot read the installer before running it, you are running whatever is on main at that moment.

Second, the platform list is a hard boundary. Linux only, with specific distributions named. There is no macOS or Windows server path, and no container image in the repository layout. Third, Reality's camouflage depends on the site you point it at being reachable and plausible from your server's IP. The README does not document what happens when that target goes down or gets blocked, and it does not describe a rollback procedure. Fourth, this is a single-server design. There is no mention of multi-node coordination, failover, or anycast, so scaling past one VPS means running the installer again and managing each host separately.

How it compares with a plain Xray install and with a hosted VPN

The honest alternative is Xray itself, configured by hand. You write the JSON, you call systemctl, you generate the keys with xray x25519. That is more work but fewer moving parts: no npm package, no Node runtime, no CLI checking for updates, and nothing between you and the config file. If you already know Xray, this project mostly saves you typing and gives you the user and quota layer on top.

The other alternative is a commercial VPN. That is a different trade. A VPN provider gives you an app, support, and no server to patch, but you share the exit IP with other customers, which matters if your goal is reaching services that block datacenter ranges. Xray VPN OneClick gives you a dedicated IP and full control, and in exchange you own the maintenance. The README's own protocol table argues VLESS+Reality is harder to detect than Shadowsocks or VMess+WebSocket+TLS, and that is the design intent behind the protocol, though the table is the project's own comparison.

Maintenance, versions and the MIT licence

The last push to the default branch was on 2026-05-18, and the most recent release is v2.0.1 from 2026-04-21. The repository is not archived. Version 2.0.0 landed on 2026-04-09 and v1.8.5 before that in January, so the release cadence through the first half of the year was steady, but the repository shows no pushes after mid-May.

Upgrade cost is mostly npm's. Because the CLI depends on update-notifier, it will tell you when a newer xray-manager exists, and `npm install -g xray-manager` is the upgrade path. That only updates the management CLI, not the Xray binary the installer placed on the host, and the README does not describe how the underlying Xray core is upgraded. Budget for that separately.

The licence is MIT, which is permissive: you can use, modify and redistribute the code, including commercially, provided the copyright notice and licence text are kept. The repository also carries a NOTICE file, which is worth reading since it can add attribution terms on top of the base licence. That is a description of the licence text, not legal advice; if you plan to redistribute this inside a product, have someone qualified read LICENSE and NOTICE together.

Editorial conclusion

Adopt it if you have a Linux VPS with a public IP and you want VLESS+Reality without hand-writing Xray configs or owning a domain. Skip it if you need a GUI, a non-Linux server, or a protocol other than Xray's. Before trusting it, read scripts/install.sh and src/ to see what the installer writes to /etc and how the npm package reaches root.

Frequently asked questions

Official sources

1. DanOps-1/Xray-VPN-OneClick on GitHub
2. License: MIT
3. Project website
4. README
5. Releases