Tips

Generate Keys

Reality keypair:

shoes generate-reality-keypair

Optional Reality post-quantum authentication keys:

shoes generate-reality-mldsa65-keypair

Keep mldsa65_seed on the server; distribute only mldsa65_verify to clients.

Shadowsocks 2022 password:

shoes generate-shadowsocks-2022-password 2022-blake3-aes-256-gcm

UUID:

uuidgen

TLS certificate fingerprint:

openssl x509 -in cert.pem -noout -fingerprint -sha256

Security Best Practices

• Use strong, random passwords
• Keep private keys secure
• Use 127.0.0.1 instead of 0.0.0.0 for local-only access
• Use firewall rules to restrict access
• Enable client certificate authentication for sensitive services
• Use Vision with Reality for maximum privacy

Performance Tips

• Enable vision: true for TLS-in-TLS scenarios
• Use tcp_settings.no_delay: true for low latency
• Set quic_settings.num_endpoints to match worker threads
• Use QUIC transport for high-latency or lossy networks

Common Issues

• “Address already in use”: Change port or stop conflicting service
• “Permission denied”: Ports < 1024 require root/admin
• Reality connection fails: Verify keys match, UUID matches, SNI matches server’s reality_targets key
• Vision not working: Ensure inner protocol is VLESS
• Config validation fails: Run with --dry-run for detailed errors