skills.rest
sukbearai
sukbearaiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

digitalocean-cf-vless-deploy

Provision a DigitalOcean VPS with Cloudflare, Nginx, 3x-ui, and VLESS WebSocket TLS.

4|Updated Jun 2, 2026
Search Tags:#cloudflare#nginx#digitalocean#3x-ui#vless#vpn deployment#websocket tls
One-click install
npx skills add https://github.com/sukbearai/king-ai --skill digitalocean-cf-vless-deploy-sukbearai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: digitalocean-cf-vless-deploy
Source: https://github.com/sukbearai/king-ai/tree/main/packages/skills/skills/digitalocean-cf-vless-deploy
Command: npx skills add https://github.com/sukbearai/king-ai --skill digitalocean-cf-vless-deploy-sukbearai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Setting up a VPN node behind Cloudflare on a fresh DigitalOcean droplet involves many fragile steps: origin certificates, Nginx reverse proxying, 3x-ui panel quirks, and subscription links that often point to unusable internal addresses. This Skill guides the full deployment so the result works with Shadowrocket through Cloudflare's proxied 443 port. ## Core Features & Use Cases - Full Stack Provisioning: Installs Nginx, Certbot with Let's Encrypt origin certificates, and 3x-ui/Xray on an Ubuntu VPS behind Cloudflare orange cloud with Full (strict) SSL. - VLESS over WebSocket/TLS: Configures a VLESS inbound on WebSocket transport through Nginx on port 443, compatible with Cloudflare's free proxy and Shadowrocket clients. - Subscription Fix: Corrects 3x-ui subscription links that default to localhost or internal ports so they decode to the real VPN domain on port 443. - Use Case: You just created a new DigitalOcean droplet and want to rebuild your VPN node with a Cloudflare-proxied domain, a working 3x-ui panel, and Shadowrocket subscription links, without manually debugging 521/526 errors or broken subscription URLs. ## Quick Start Use the digitalocean-cf-vless-deploy skill to set up my new DigitalOcean VPS at the given IP with my VPN domain behind Cloudflare, including 3x-ui, VLESS WebSocket TLS, and a working Shadowrocket subscription.

Frequently Asked Questions about digitalocean-cf-vless-deploy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy a VLESS WebSocket VPN behind Cloudflare?▼

Install Nginx and Certbot on the VPS, issue a Let's Encrypt origin certificate for the VPN domain, then install 3x-ui and create a VLESS inbound using WebSocket transport with TLS terminated at Nginx on port 443. Keep the Cloudflare record orange-cloud proxied with Full (strict) SSL mode.

How to set up 3x-ui with Nginx reverse proxy on Ubuntu?▼

Install 3x-ui with a fixed panel port bound to 127.0.0.1 and skip its built-in SSL. Then add an Nginx server block that proxies the panel base path, the VLESS WebSocket path, and the /sub/ subscription path to their local ports while Nginx owns public ports 80 and 443.

Can I use VLESS Reality with Cloudflare orange cloud proxy?▼

No. Cloudflare's free orange-cloud proxy does not carry arbitrary VLESS Reality TCP traffic, so existing Reality listeners on port 443 must be stopped and replaced with VLESS over WebSocket behind Nginx. Alternatively, keep the Reality node on a DNS-only (grey cloud) record.

Why does my 3x-ui subscription link show localhost or 127.0.0.1?▼

3x-ui generates subscription links using the inbound's internal listen address by default. Fix it by setting an inbound external proxy with dest and SNI set to your VPN domain, port 443, and forceTls enabled, so decoded links point to the domain on 443.

Why does Cloudflare return a 526 invalid SSL certificate error?▼

A 526 error means Cloudflare Full (strict) mode rejected the origin certificate because the origin lacks a valid cert for the requested hostname. Re-run certbot for that exact domain and verify Nginx serves the certificate on port 443.

Does this setup work for users in mainland China?▼

Yes, but clients must connect through the Cloudflare-proxied domain on port 443 rather than the raw Droplet IP, which may be blocked or unstable. Preferred IP or CNAME routing optimizations should only be applied after the basic WebSocket node is verified working.

Related Skills

Explore More Software Engineering Skills→
theslashdojotheslashdojo

dns

Automate Cloudflare DNS zone and record management via API or CLI.

Official
Advanced
pyworkloadpyworkload
5

multi-node

Attach, secure, and monitor additional 3x-ui panels as nodes of a master panel.

Community
Advanced
jholhewresjholhewres
3

health

Scan HTTP endpoints, CLI service statuses, system resources, and SSL certificate expiry.

Community
Intermediate
julianobarbosajulianobarbosa
7

Azure Integration

Manage Cloudflare DNS records for Azure-hosted applications via REST API.

Community
Advanced