1
2
3

apt update -y
apt -y install wget
mkdir /opt/tuic && cd /opt/tuic

1
2

wget https://github.com/EAimTY/tuic/releases/download/tuic-server-1.0.0/tuic-server-1.0.0-x86_64-unknown-linux-musl -O /opt/tuic/tuic-server
chmod +x /opt/tuic/tuic-server

1
2

wget https://github.com/EAimTY/tuic/releases/download/tuic-server-1.0.0/tuic-server-1.0.0-aarch64-unknown-linux-musl -O /opt/tuic/tuic-server
chmod +x /opt/tuic/tuic-server

1
2

cat /proc/sys/kernel/random/uuid # 获取UUID,后面记得替换
vim /opt/tuic/config.json # 将下面json内容修改后粘贴进来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

// 用于监听的套接字地址,默认443,如果端口被占用可以换成其他,建议用其他的端口,另外tuic暂不支持回落
// 用户列表，包含用户UUID和密码
// 证书文件的路径
// 私钥文件的路径
// 可选。拥堵控制算法，可用选项：
// "cubic", "new_reno", "bbr"
// 默认："cubic" ,个人推荐 "bbr"
// 可选。应用层协议的协商
// 默认为空（无ALPN）
// 可选。如果服务器应该为中继IPv6 UDP数据包创建单独的UDP套接字
// 默认：true
// 可选。在服务器端启用0-RTT QUIC连接握手。
// 这对性能影响不大，因为该协议是完全复用的。
// 警告：强烈建议禁用该功能，因为它容易受到重放攻击。参见https://blog.cloudflare.com/even-faster-connection-establishment-with-quic-0-rtt-resumption/#attack-of-the-clones
// 默认值：false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

{
    "server": "[::]:443",
    "users": {
        "00000000-0000-0000-0000-000000000000": "PASSWORD_0"    
    },
    "certificate": "/opt/tuic/fullchain.pem",
    "private_key": "/opt/tuic/privkey.pem",
    "congestion_control": "bbr",
    "alpn": ["h3", "spdy/3.1"],
    "udp_relay_ipv6": true,
    "zero_rtt_handshake": false,
    "auth_timeout": "3s",
    "max_idle_time": "10s",
    "max_external_packet_size": 1500,
    "gc_interval": "3s",
    "gc_lifetime": "15s",
    "log_level": "warn"
}

1

vim /lib/systemd/system/tuic.service

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

[Unit]
Description=Delicately-TUICed high-performance proxy built on top of the QUIC protocol
Documentation=https://github.com/EAimTY/tuic
After=network.target

[Service]
User=root
WorkingDirectory=/opt/tuic
ExecStart=/opt/tuic/tuic-server -c config.json
Restart=on-failure
RestartPreventExitStatus=1
RestartSec=5

[Install]
WantedBy=multi-user.target

1
2
3

systemctl daemon-reload # 重新加载系统管理守护进程(systemd) 的配置文件
systemctl enable --now tuic.service # 启动tuic服务并设置开机自启
systemctl status tuic.service # 查看状态

1
2
3
4
5
6
7

apt -y install certbot # 安装certbot
certbot certonly \
--standalone \
--agree-tos \
--no-eff-email \
--email example@gmail.com \
-d xx.xxx.xx

1
2

systemctl enable --now certbot.timer # 启动并设置开机自动启动
systemctl status certbot.timer # 查看状态

1
2
3

# 创建软连接
ln -s -v /etc/letsencrypt/live/vless3.lanyundev.com/fullchain.pem /opt/tuic/fullchain.pem
ln -s -v /etc/letsencrypt/live/vless3.lanyundev.com/privkey.pem /opt/tuic/privkey.pem

1

vim /etc/letsencrypt/renewal-hooks/post/tuic.sh

1
2
3

#!/bin/bash

systemctl restart tuic.service

1

chmod +x /etc/letsencrypt/renewal-hooks/post/tuic.sh

1

openssl x509 -noout -fingerprint -sha256 -inform pem -in /opt/tuic/fullchain.pem

1
2
3
4
5
6
7
8
9
10

# 查看证书列表
certbot certificates
# 手动续订,后面--manual哪些都是可选
certbot renew  --manual --preferred-challenges dns --manual-auth-hook "/脚本目录/au.sh python txy add" --manual-cleanup-hook "/脚本目录/au.sh python txy clean"
# 使用 crontab 定时更新证书,示例
# 注意只有成功 renew 证书，才会重新启动 Nginx
1 1 */1 * * root certbot-auto renew --manual --preferred-challenges dns --deploy-hook  "service nginx -s reload" --manual-auth-hook "/脚本目录/au.sh php aly add" --manual-cleanup-hook "/脚本目录/au.sh php aly clean"
# 撤销证书
sudo certbot revoke --cert-name example.com
sudo certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem