Cloudflare VLESS and Trojan Proxy Deployment

This method (current version: 25.5.4) is designed for local deployment and local configuration editing. It does not use third-party subscription converters, ensuring your node information remains private.

Key Features:

• Workers Mode: Supports vless+ws+tls, trojan+ws+tls, vless+ws, and trojan+ws.
• Pages Mode: Supports vless+ws+tls and trojan+ws+tls.
• Subscription Support: Supports single node links, aggregated nodes, sing-box subscriptions, and clash subscriptions.
• NAT64 Support: VLESS NAT64 versions automatically fill proxyip.

The script follows specific allocation logic based on whether IPv6 is available and which port (80 or 443) is being used:

With IPv6 support:

• Port 80 series: 3 IPv4 + 2 IPv6 + 2 Domains
• Port 443 series: 2 IPv4 + 2 IPv6 + 2 Domains

Without IPv6 support:

• Port 80 series: 4 IPv4 + 3 Domains
• Port 443 series: 3 IPv4 + 3 Domains

You can override the proxyip using two methods:

1. Global Node Variable

Set the proxyip variable as described in the VLESS/Trojan configuration. This affects all nodes that do not have a specific path-based proxyip set.

2. Single Node Path Method

You can specify a proxyip for a specific node by appending a path parameter. This takes precedence over the global proxyip.

Note: Changing the path-based proxyip only affects that specific node.

To run the script on iOS, use iSH version 1.2.2 (newer versions have bugs that cause the script to hang). You may need to use TrollStore or other methods to install this specific version.

1. Install iSH 1.2.2.
2. Install dependencies:

   apk add curl bash

3. Run the script (see next record for the command).

To view your configuration or share links via a web browser, use the following URL patterns:

• CF Vless: https://<workers_or_pages_or_custom_domain>/<your_uuid>
• CF Trojan: https://<workers_or_pages_or_custom_domain>/<your_password>

Note: If your domain is blocked, you must use a proxy to access these URLs.

Once the script has run and generated the configuration:

1. Go to your Cloudflare Worker settings.
2. Navigate to Settings -> Variables and Secrets.
3. Click Add Variable (or similar action to add bulk values).
4. Click into the black input box below the variable name and press CTRL+V to paste the clipboard content generated by the script.
5. If some variables are missing, click Save and Deploy to ensure all settings are applied.

Before running the script, you must organize your optimized IP and domain results in the following directory structure so the script can locate the latest data:

1. Create a History folder: Inside the domain and ip directories, ensure a History folder exists.
2. Organize by date: Inside History, create a folder named using the YYYY_MM-DD format (e.g., 2026_02-11).
3. Place domain results: Put your optimized domain results in domain/History/YYYY_MM-DD/CDNym.txt.
4. Place IP results:
   • For IPv4: Place results in ip/History/YYYY_MM-DD/result.csv.
   • For IPv6: Place results in ip/History/YYYY_MM-DD/result_v6.csv. (Tip: Use the _v6 suffix for IPv6 files if applicable).

This Python script automates the process of importing optimized IP and domain variables into Cloudflare Workers. Instead of manually copying results from .txt or .csv files, the script aggregates the latest test results, generates a worker.env file, and copies the configuration to your clipboard for bulk import into the Cloudflare dashboard.

python 自动生成变量导入cf.py

To run the Cloudflare CDN optimized public domain script on Android, you must use the official Termux app (the Google Play Store version is not compatible).

1. Install Termux.
2. Update dependencies:

   pkg upgrade

3. Run the script (see next record for the command).

The Fragment (分片) feature helps bypass TLS blocking on domains that have been blocked by firewalls, allowing Workers domains to support TLS nodes.

Important Notes:

• If you are using a custom domain or a Pages domain that is NOT subject to TLS blocking, you do not need to enable Fragment.
• For Workers domains, the six 443-port TLS nodes are unusable if the client does not support and enable the Fragment feature.
• Known Issue: Currently, the TLS fragment functionality for Workers may be ineffective.
• Trojan+WS Limitation: Clients like Shadowrocket, v2box, v2rayN, and v2rayNG have mandatory TLS requirements for trojan+ws which may cause connection failures. Clash subscriptions do not support trojan+ws nodes.

This method is intended for use on local platforms like soft routers. It supports Workers domains, Pages domains, and custom domains. You can choose between ECH-TLS, standard TLS, or no TLS modes to handle different blocking scenarios.

Use the cfsh.sh script or the ygkkk/cfsh Docker image.

curl -sSL https://raw.githubusercontent.com/yonggekkk/Cloudflare_vless_trojan/main/s5http_wkpgs/cfsh.sh -o cfsh.sh && chmod +x cfsh.sh && bash cfsh.sh