untitled

# ============================================================
#  Automated VLESS + Reality (Xray) setup for Windows 11 / Azure VM
#  Run: right-click -> "Run with PowerShell"  (it self-elevates)
# ============================================================

# ---------- EDIT THESE ----------
$SNI        = "ekb.eg"       # SNI / Reality target
$Port       = 443            # Inbound port (must match Azure NSG rule)
$AllowedIPs = @()            # Windows Firewall whitelist, e.g. @("1.2.3.4","5.6.7.8"). Empty = allow all
$InstallDir = "C:\xray"
$TaskName   = "XrayVLESS"
# --------------------------------

$ErrorActionPreference = "Stop"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# --- Self-elevate to Administrator ---
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Start-Process powershell -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    exit
}

Write-Host "setup-vless.ps1 v3" -ForegroundColor DarkGray
try {
    Write-Host "[1/6] Stopping old instance (if any)..." -ForegroundColor Cyan
    if (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue) {
        Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
        Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false
    }
    Get-Process xray -ErrorAction SilentlyContinue | Stop-Process -Force
    New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null

    Write-Host "[2/6] Downloading latest Xray-core..." -ForegroundColor Cyan
    $rel   = Invoke-RestMethod "https://api.github.com/repos/XTLS/Xray-core/releases/latest" -UseBasicParsing
    $asset = $rel.assets | Where-Object { $_.name -eq "Xray-windows-64.zip" }
    $zip   = Join-Path $env:TEMP "xray.zip"
    Invoke-WebRequest $asset.browser_download_url -OutFile $zip -UseBasicParsing
    Expand-Archive -Path $zip -DestinationPath $InstallDir -Force
    Remove-Item $zip -Force
    $xray = Join-Path $InstallDir "xray.exe"

    Write-Host "[3/6] Generating UUID and Reality keys..." -ForegroundColor Cyan
    $uuid = [guid]::NewGuid().ToString()
    $raw  = & $xray x25519 | ForEach-Object { "$_" }
    $vals = [ordered]@{}; $last = $null
    foreach ($l in $raw) {
        if ($l -match '^\s*([^:]+?)\s*:\s*(\S*)\s*$') { $last = $Matches[1]; $vals[$last] = $Matches[2] }
        elseif ($l.Trim() -and $last) { $vals[$last] += $l.Trim() }   # re-join wrapped lines
    }
    $priv = ($vals.GetEnumerator() | Where-Object { $_.Key -match 'Private' } | Select-Object -First 1).Value
    $pub  = ($vals.GetEnumerator() | Where-Object { $_.Key -match 'Public|Password' } | Select-Object -First 1).Value
    if (-not $priv -or -not $pub) { throw "Could not parse x25519 keys:`n$($raw -join "`n")" }
    $shortId = -join ((1..8) | ForEach-Object { '{0:x2}' -f (Get-Random -Maximum 256) })

    Write-Host "[4/6] Writing config..." -ForegroundColor Cyan
    $config = @{
        log       = @{ loglevel = "warning" }
        inbounds  = @(@{
            port     = $Port
            protocol = "vless"
            settings = @{
                clients    = @(@{ id = $uuid; flow = "xtls-rprx-vision" })
                decryption = "none"
            }
            streamSettings = @{
                network  = "tcp"
                security = "reality"
                realitySettings = @{
                    show        = $false
                    dest        = "${SNI}:443"
                    xver        = 0
                    serverNames = @($SNI)
                    privateKey  = $priv
                    shortIds    = @($shortId)
                }
            }
            sniffing = @{ enabled = $true; destOverride = @("http","tls","quic") }
        })
        outbounds = @(@{ protocol = "freedom"; tag = "direct" })
    }
    $json = $config | ConvertTo-Json -Depth 12
    [System.IO.File]::WriteAllText((Join-Path $InstallDir "config.json"), $json, (New-Object System.Text.UTF8Encoding($false)))

    Write-Host "[5/6] Firewall + auto-start at boot..." -ForegroundColor Cyan
    Get-NetFirewallRule -DisplayName "Xray VLESS" -ErrorAction SilentlyContinue | Remove-NetFirewallRule
    $fw = @{ DisplayName = "Xray VLESS"; Direction = "Inbound"; Protocol = "TCP"; LocalPort = $Port; Action = "Allow" }
    if ($AllowedIPs.Count -gt 0) { $fw.RemoteAddress = $AllowedIPs }
    New-NetFirewallRule @fw | Out-Null

    $action    = New-ScheduledTaskAction -Execute $xray -Argument "run -c `"$InstallDir\config.json`"" -WorkingDirectory $InstallDir
    $trigger   = New-ScheduledTaskTrigger -AtStartup
    $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
    $settings  = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
                    -StartWhenAvailable -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) `
                    -ExecutionTimeLimit ([TimeSpan]::Zero)
    Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null
    Start-ScheduledTask -TaskName $TaskName
    Start-Sleep -Seconds 3

    Write-Host "[6/6] Verifying..." -ForegroundColor Cyan
    $listening = Get-NetTCPConnection -LocalPort $Port -State Listen -ErrorAction SilentlyContinue
    if (-not $listening) { Write-Warning "Port $Port is not listening. Check $InstallDir\config.json" }

    try   { $ip = (Invoke-RestMethod "https://api.ipify.org" -UseBasicParsing).Trim() }
    catch { $ip = "YOUR_SERVER_PUBLIC_IP" }

    $link = "vless://${uuid}@${ip}:${Port}?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${SNI}&fp=chrome&pbk=${pub}&sid=${shortId}&type=tcp#ekb-reality"
    $link | Out-File (Join-Path $InstallDir "client-link.txt") -Encoding ascii

    Write-Host ""
    Write-Host "================ DONE ================" -ForegroundColor Green
    Write-Host "Server IP : $ip"
    Write-Host "Port      : $Port"
    Write-Host "UUID      : $uuid"
    Write-Host "SNI       : $SNI"
    Write-Host "Public key: $pub"
    Write-Host "Short ID  : $shortId"
    Write-Host ""
    Write-Host "Import this link into v2rayNG / Hiddify / Nekoray:" -ForegroundColor Yellow
    Write-Host $link
    Write-Host ""
    Write-Host "Saved to: $InstallDir\client-link.txt"
    Write-Host "Reminder: open port $Port/TCP in the Azure NSG (see instructions)." -ForegroundColor Yellow
}
catch {
    Write-Host "ERROR: $($_.Exception.Message)" -ForegroundColor Red
}
Read-Host "Press Enter to close"