Technical documentation

How to set up a NaiveProxy server

NaiveProxy can be hosted as inbound in sing-box with TLS and domain name. The node structure, configuration and basic checks are described below.

Return to MONO VPN Compare protocols

1. DNS and ACME

Create a DNS-only A record, for example naive.example.com, directed to the server IP. To automatically issue a certificate, the domain must resolve to this node, and TCP 80 and 443 must be accessible from the outside. Do not publish the sing-box service API to the Internet.

2. Installation of sing-box

Use the official sing-box repository and the current version, which contains the required NaiveProxy type. After installation, check the binary and configuration with a regular command.

sing-box version
sing-box check -C /etc/sing-box

3. Minimum configuration structure

{
  "inbounds": [{ "type": "naive", "listen": "::", "listen_port": 443,
    "users": [{"username": "ACCOUNT", "password": "GENERATE_ME"}],
    "tls": {"enabled": true, "server_name": "naive.example.com",
      "acme": {"domain": ["naive.example.com"]}}
  }], "outbounds": [{"type": "direct", "tag": "direct"}]
}

In production, set ACME email, log limits, cache file and a separate random secret for the local API. Generate user passwords cryptographically randomly and do not reuse them.

4. Account pool

Preload

Inbound users are loaded from the configuration. To scale, prepare a pool of accounts and a managed reboot plan.

Access status

Store the server, port, server name, username and password in a secure storage. Releasing expired accounts must be idempotent.

5. Monitoring and verification

Check the status of sing-box and TLS certificate.
Monitor CPU, RAM, active connections and traffic speed.
Store the local API only on localhost and close it with a firewall.
Check external port 443 and test profile with a separate client.

Per-user statistics require separate support in the assembly and agent. A snapshot of server-wide traffic in itself does not prove the activity of a specific user.

Safety

Don't put secrets in frontend, Git, public instructions or URLs. Use separate API secrets, SSH keys, configuration backups, and regular rotation. For production, first test the configuration on a separate domain.