XHHTP работает без Reality

[jabacrack]

What happened?

Название подключения в 3x-ui панели "VLESS-Reality-XHTTP", но подключение не использует Reality, опция Security установлена в None. Учитывая, что это подключение, согласно документации, считается запасным, на случай если основное перестанет работать и более безопасным, я думаю тут ошибка в конфигурации.

Setup mode

Domain mode (with Caddy + HAProxy)

When does it fail?

Other

Doctor output

Meridian v3.17.2

  → Using server: <my_server_ip>
  → Checking SSH connectivity to root@<my_server_ip>
  ✓ SSH connection successful

  Meridian Diagnostics
  Collecting system info for bug reports...
  Note: secrets (passwords, UUIDs, keys) are redacted.


  ─────────────────────────────────────────

  Diagnostics collected.

  Tip: meridian doctor --ai -- paste directly into ChatGPT or Claude for help

  1. Review the output below for any private info you want to remove
  2. Copy the markdown block into a new issue:
     https://github.com/uburuntu/meridian/issues/new

  ─────────────────────────────────────────

### Local Machine

OS: Linux-6.6.114.1-microsoft-standard-WSL2-x86_64-with-glibc2.39
Meridian: 3.17.2
Server deployed with: 3.17.2


### Deployment

Mode: domain
Protocols: Reality, XHTTP, WSS
Clients: 4


### Server

$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
$ uname -r
6.12.86+deb13-cloud-amd64
$ uptime
08:01:54 up 1 day, 23:11,  1 user,  load average: 0.09, 0.08, 0.03
$ df -h / 2>/dev/null | tail -1
/dev/vda1       9.0G  2.7G  6.0G  31% /
$ free -h 2>/dev/null | grep Mem
Mem:           1.9Gi       561Mi       304Mi       664Ki       1.3Gi       1.4Gi


### Docker

$ docker --version 2>&1
Docker version 29.4.3, build 055a478
$ docker ps --format 'table {{.Names}}  {{.Status}}     {{.Ports}}' 2>&1
NAMES     STATUS        PORTS
3x-ui     Up 47 hours


### Xray Process

running (PID 72)


### 3x-ui Logs

$ docker logs 3x-ui --tail 50 2>&1 | grep -v '^\s*$' | sort -u | tail -20
INFO - ih0juq0kvrra logged in successfully
INFO - ih0juq0kvrra logged in successfully, Ip Address: 127.0.0.1
WARNING - [LimitIP] Access log path is not set, Please configure the access log path in Xray configs.


### Nginx Errors

$ tail -10 /var/log/nginx/error.log 2>/dev/null
2026/05/13 00:19:31  10374#10374: *53889 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 45.9.168.192, server: 0.0.0.0:443, upstream: "127.0.0.1:8443", bytes from/to
client:52/7, bytes from/to upstream:7/52
2026/05/13 06:23:47  10374#10374: *57236 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 109.110.47.30, server: 0.0.0.0:443, upstream:
"[2a02:26f0:1180:19b::356e]:443", bytes from/to client:8147/9543, bytes from/to upstream:9543/8147
2026/05/13 07:30:21  10373#10373: *63431 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 45.95.59.34, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes from/to
client:1946/8961, bytes from/to upstream:8961/1946
2026/05/13 07:45:37  10374#10374: *65243 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 45.95.59.34, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes from/to
client:2050/8961, bytes from/to upstream:8961/2050
2026/05/13 07:45:37  10374#10374: *65244 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 45.95.59.34, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes from/to
client:2006/8961, bytes from/to upstream:8961/2006
2026/05/13 07:45:37  10374#10374: *65245 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 45.95.59.34, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes from/to
client:2124/8961, bytes from/to upstream:8961/2124
2026/05/13 17:54:45  10373#10373: *119009 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 185.125.112.206, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes
from/to client:2012/8961, bytes from/to upstream:8961/2012
2026/05/13 17:56:45  10373#10373: *119142 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 185.125.112.206, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes
from/to client:2134/8961, bytes from/to upstream:8961/2134
2026/05/13 18:13:55  10373#10373: *125885 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 185.125.112.206, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes
from/to client:1318/8961, bytes from/to upstream:8961/1318
2026/05/14 07:09:10  10373#10373: *139653 recv() failed (104: Connection reset by peer) while proxying and
reading from upstream, client: 185.125.112.206, server: 0.0.0.0:443, upstream: "127.0.0.1:10300", bytes
from/to client:2145/8961, bytes from/to upstream:8961/2145


### TLS Certificate

valid until 2026-08-10 (88 days)


### Listening Ports

$ ss -tlnp sport = :443 or sport = :80 or sport = :8443 or sport = :8444 2>&1
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      511        127.0.0.1:8443      0.0.0.0:*
users:(("nginx",pid=10374,fd=10),("nginx",pid=10373,fd=10),("nginx",pid=7134,fd=10))
LISTEN 0      511          0.0.0.0:443       0.0.0.0:*
users:(("nginx",pid=10374,fd=15),("nginx",pid=10373,fd=15),("nginx",pid=7134,fd=15))
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*
users:(("nginx",pid=10374,fd=5),("nginx",pid=10373,fd=5),("nginx",pid=7134,fd=5))


### Firewall (UFW)

$ ufw status verbose 2>&1
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)


### Geo-blocking

active (2 rules → blackhole)


### Camouflage Target (www.microsoft.com)

$ echo | openssl s_client -connect www.microsoft.com:443 -servername www.microsoft.com 2>/dev/null | grep -E
'subject=|issuer=|CONNECTED'
CONNECTED(00000003)
subject=C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=www.microsoft.com
issuer=C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04


### Domain DNS (<my_domain>)

$ dig +short <my_domain> @8.8.8.8 2>/dev/null
172.67.163.36
104.21.15.167

Error output

Server OS

No response

Local OS

No response